svchost.exe memory leak under XP Pro SP3

[Omastar]

This has been really annoying the hell out of me lately. Whenever I boot into XP, one of the svchost processes invariably starts hogging more and more RAM until it finally settles around 1,200,000K. This happens within the span of a couple hours from startup. The thing is, I did a tasklist /svc in Command Prompt and the particular offending svchost is tied to a lot of processes (WebServ, Dhcp, etc.), and I've tried and tried to get rid of the memory leak, but I can't.

Also note that manually killing the process gives me issues with Winamp. Since I stream music through Winamp from my file server, whenever I kill svchost.exe, later on I get a "bad DirectSound driver" error when trying to play music or a game.

Any ideas? It seems this only started after installing SP3. Not implying causation here, but the correlation is pretty damn hard to ignore. I may go back to SP2...

[[XC] Lead Head]

svc host has basically to do with the multimedia side of windows, sound, internet, etc.. I would try updating your sound card and network drivers.

[Omastar]

I just updated my X-Fi drivers, but I'll try finding new drivers for my Broadcom NIC.

[twilyth]

Not to be alarmist, but some malware likes to hijack svchost. Try a free scan from Sophos or try Avira. If you use zone alarm, be sure to enable component control.

[Jazz_Data]

Lead Head;2695692']svc host has basically to do with the multimedia side of windows, sound, internet, etc..

Not at all....

svchost.exe is a generic process that starts other processes (services)

It is true that some malware will create services thus affecting svchost

But in your case, It might just be a memory leak with sp3 and another service

I would use Process Explorer from sysinternals
(http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx?wt.svl=leftnav.aspx?wt.svl=leftnav)

Click on the svchost.exe that is taking all cpu / memory, check .dll's linked with that svchost.exe which will guide you in solving your problem.

You could also stop services one by one (run -> services.msc) and figure out which one is the culprit.

[Serra]

Contact Microsoft. SP3 is still in beta, right? So give them a call, let them know, and you'll probably get a small team of men in thick glasses examining the issue for you.

[[XC] riptide]

Omastar. I'm on SP2 still. But if I leave my rigs on for a long time, (which I do... I'm a Cruncher) one svchost.exe instance gets bigger and bigger over time. Now were talking a few days, but the biggest I've found recently was something like 500megs. LOL

[MentholMoose]

Try running Process Explorer (http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx) to see if you can figure out what service is causing the problem.

[Demo]

riptide;2696201']Omastar. I'm on SP2 still. But if I leave my rigs on for a long time, (which I do... I'm a Cruncher) one svchost.exe instance gets bigger and bigger over time. Now were talking a few days, but the biggest I've found recently was something like 500megs. LOL

Never noticed my scvhost get that huge, even for 2 months of no single reboot

[Omastar]

Thanks for the responses. I'll try Process Explorer. And twilyth, I was considering the malware aspect to this as well, but I ran several rootkit/malware/virus scans with no results to speak of.

[Omastar]

Okay, using Process Explorer, I've identified the offending DLL tied to the offending svchost.exe process. The DLL in question is Dhcp, and when I kill it, of course, I lose my internet connection.

As soon as I kill the Dhcp DLL, the memory usage of svchost.exe levels off and doesn't rise anymore.

What can I do? :(

[Omastar]

Update: well, call Dan Rather, it appears I was right (yet again) in my assumption that SP3 played a role in this imbroglio.

I uninstalled SP3, installed a hotfix, and now the same svchost process is staying around 30,000K, which is a large departure from 1,200,000K.

I guess it isn't wise to always trust release candidates as if they were final builds...