[Teknologic]

Hello, this is my first post here but I've been frequenting these forums before (they always come up when I'm googling some problems).
So that's why I decided to register here.

I hope I posted in the right section, I don't think this is as much of a security problem as it is a great annoyance.

So here's my story: Since about a week I noticed my RAM was being used more than before (meaning my % used RAM was higher then usual).
So I tried closing all of the apps I was running, to little avail. My ram usage dropped a few percents but was still pretty big.
So when I checked the task manager I saw svchost was using the most memory, which was almost never the case before.
But whenever I booted my comp my ram usage seemed normal, so I just assumed that I cluttered my ram when using the comp.

But then I decided to test if this was true.
I booted my pc and left it idle for like an hour or two (no screensaver or standy or anything ofc) and when I came back I noticed my ram usage had nearly doubled!
After boot, ram usage was about 27%, 2 hours after it was nearly 50%
So I tested it again and watched my svchost (the one with the most memory-usage, because there are many svchosts). At boot it used 45.760 and after about 2 hours, this had become 78.900
What I also had noticed during these two hours is that in my network usage, every second or so I was transmitting and receiving small packages.
So every second or so I had an uprate of about 7.5 kbit and downrate about the same (don't remember specifically). This has stopped by now, aswell as the increasing memory usage of svchost (around 79.000-80.000 now).

That's about all I know and can tell about the problem.
Except perhaps that a while before I noticed my ram problem, i noticed my dualcore's (T8100) two processors where not really processing as before.
I monitor my cpu usage and when I look at the graph, it used to be two very different paths(often one at 90-100% and the other at 40-50% when using some more powerfull applications). Now the two cores seem to be following almost the same path on the graph (perhaps one's usage a few percent lower).

I don't know if this is related and what is up with that (havn't found anything about it on the web), but who knows, it might just help figuring out the prob.

My OS is Vista Home Premium
I am on a HP Pavillion DV9885eb
Intel T8100 dualcore (2.10ghz)
3 GB Ram (1x1 , 1x2)

Thanks alot in advance for any help or useful tips!!

Logic

[zackthewack]

You can knock a lot of these off by disabling services you don't need running. To find out what services certain svchosts are running, do this:

Open up your task manager. Either by CTRL+ALT+DELETE (Not backspace) or by going to Run and typing taskmgr.exe.

Once you have the task manager open, you can right click on any of the svchosts and click go to service(s). It should have selected all the services that are being run by that svchost. If not, you can double click on it and go to the Services tab where you can choose to stop one of the services.

To disable these services, do this:

Go to Control Panel and go to Services from the admin tools section, or you can go to run and type services.msc

Once that happens you can select any service in the list and stop it or right click and go to properties and change the start up type to disabled. This will keep it from not starting up as your computer starts up.

Also you can choose to stop it immediately so you can get rid of all these services running. Just go through the list and see which services you think you wont need.

If you need help on one of the services you are about to disable, just reply back to here with the name of the service.

Hopefully this is what you wanted.


Also try the simple Disk Defragment and Disk Cleanup. That can help speed up the computer as well.

[Teknologic]

Hi and thanks for the quick reply

I've selected go to services for the svchost that is hogging my memory to discover it has 144 services in it o_O

Some of those have been stopped (probably because I sort out my startup services once in a while), but most of those are running.

As it'll be very tough for me to determine which of those processes has been eating away my memory slowly, is there a way I can check the memory usage for those services? Or date it was added to svchost or something?

Anyway, I tought svchost was a service at itself, didn't know it represented such a massive group of services. Another thing I've learned

Again thanks for the help, I'll report back if I made any progress.

EDIT: oh PS: I regularly defrag and cleanup but thx for the pointers

[zackthewack]

Haha alright :P


Umm, there should be a way. I'm not exactly sure because I only have one svchost but no other separate ones so I can't really experiment to figure it out for you. Try to look through the services or something and see if you can find that out. I'll try to keep looking myself though.

[joeten]

hi just to be sure you have no virus or malware run your progs for this it cant hurt to check

[Teknologic]

Originally Posted by zackthewack

Haha alright :P


Umm, there should be a way. I'm not exactly sure because I only have one svchost but no other separate ones so I can't really experiment to figure it out for you. Try to look through the services or something and see if you can find that out. I'll try to keep looking myself though.

Really peculiar that you have only one svchost, because I have 6 o_O

But the ones that stand out most at this time are the ones with 82.000 and 72.000 kB

So I've been going through the services of the first svchost and so far I'm thinking about disabling some, but I'm not sure if that's a smart idea or what they do exactly.
So these are the ones so far:

seclogon - Secondary Logon
lanmanserver - Server
iphlpsvc - IP Helper
gpsvc - Group Policy Client (how can I disable this? )
CertPropSvc - Certificate Propagation

Any do's or don'ts here? Tips?


There where about 16 services running under the biggest svchost process

Thanks for the help!

[joeten]

hi basically if you dont know dont touch you could be shutting down your system

[zackthewack]

seclogon is for any kind of secondary log ons that you have on your computer. If you disable it then obviously those will fail to load and you can't use them. If there really isn't anything depending on that service then you should be okay to disable it.

If you happen to disable something you need, you can just turn off your computer and turn it back on. Before actually disabling the process, just turn it off to make sure it doesn't mess up anything on the computer. If it doesn't mess up anything that you normally use, then you should be fine. When you restart the system it should turn back on. As long as you don't disable it from starting when Windows is started.

I am going to say not to disable lanmanserver. This is something that turns on during start up and looks at the configuration of your Hardware and makes changes to the Service if necessary.

As for iphlpsvc, it offers IPv6 connectivity on a IPv4 network. I am pretty sure this has something to do with websites..? Not exactly sure on this one.

To disable gpsvc, your going to need to delete something out of your registry and then re boot the computer. Here is what you will do; Go to Run, Type RegEdit, press Enter. When that opens find this registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc\". Delete the Services key and then reboot the computer. This will reset GPSVC and enable you to disable it after reboot. Remember to do this at your own risk and be sure to make a system checkpoint before doing this. Just to be on the safe side

CertPropSvc is a service that allows Smart Cards to supply trustworthy root certificates which, among other uses, can be used as a method of logon in Vista. If you don’t use Smart Cards, you don’t need this service, though because it’s set to manual by default, you won’t gain anything by disabling it. So if you don't use them, you don't need it.

I'm not a pro on computers or anything, but I'm at least trying to throw out something so you know what you are working with.

[Teknologic]

Originally Posted by joeten

hi basically if you dont know dont touch you could be shutting down your system

Yeah, that's kinda why I'm asking you guys, because I may know some of what these services do, but not to the full extent.

Shutting down the system wouldn't really be a problem, because then I'd know what service I need to enable.

What I fear more is that I disable a service, and about a month later I'd need a part of my OS that's linked to that service and it won't work. But by then I'd be clueless it would be because I disabled that service.

So that's why I'd like to see some pointers and such, if any of you would be so kind

[Teknologic]

Originally Posted by zackthewack

seclogon is for any kind of secondary log ons that you have on your computer. If you disable it then obviously those will fail to load and you can't use them. If there really isn't anything depending on that service then you should be okay to disable it.

If you happen to disable something you need, you can just turn off your computer and turn it back on. Before actually disabling the process, just turn it off to make sure it doesn't mess up anything on the computer. If it doesn't mess up anything that you normally use, then you should be fine. When you restart the system it should turn back on. As long as you don't disable it from starting when Windows is started.

I am going to say not to disable lanmanserver. This is something that turns on during start up and looks at the configuration of your Hardware and makes changes to the Service if necessary.

As for iphlpsvc, it offers IPv6 connectivity on a IPv4 network. I am pretty sure this has something to do with websites..? Not exactly sure on this one.

To disable gpsvc, your going to need to delete something out of your registry and then re boot the computer. Here is what you will do; Go to Run, Type RegEdit, press Enter. When that opens find this registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc\". Delete the Services key and then reboot the computer. This will reset GPSVC and enable you to disable it after reboot. Remember to do this at your own risk and be sure to make a system checkpoint before doing this. Just to be on the safe side

CertPropSvc is a service that allows Smart Cards to supply trustworthy root certificates which, among other uses, can be used as a method of logon in Vista. If you don’t use Smart Cards, you don’t need this service, though because it’s set to manual by default, you won’t gain anything by disabling it. So if you don't use them, you don't need it.

I'm not a pro on computers or anything, but I'm at least trying to throw out something so you know what you are working with.

Hello, thanks for the reply.
As far as IPv6 goes I just gathered it's kinda a new protocol of IPv4, but it's not really in use yet (That is a much as my prof would let on).

Do you perhaps know more about what Group Policy Client does exactly?
Because I'm still trying to determine which service is gradualty consuming more ram after startup.

It still really bothers me that after two hours i've practicly lost 20% of my ram and I really don't know where it went

[zackthewack]

I don't really know anymore about what it does. I am fairly sure it's not running on my system though.

Is your computer new or have you had it for a while?

[Teknologic]

I've had it for about a year now. But as far as I know Group Policies has something to do with a network administrator setting permissions for large user groups (or something of that sort). But since I'm not really part of any network I don't see why I shouldn't disable it. I'm a home user using vista home premium.
Who knows, this could be the service consuming all the ram.

But for your solution to this problem...
What exactly do you mean by delete the Services key?

Here's what I have in that path of my registry..

[zackthewack]

Wow my bad. Haha. I meant the Security key.

[Teknologic]

Ohh ok, makes more sense to me now

But all that security key does is prevent me from disabling the service, right? If I'd want to enable the service again, that should be no problem I suppose?

thanks for your help btw, my knowledge of the windows registry is quite poor

[Teknologic]

Bump, thanks for the help by the way, I've been able to disable gpsvc and it turns out that was the service hogging the ram and constantly connecting to smth.

However, my laptop boots a bit slower and I always get the message that that service is not running etc.
So my guess is, Vista prioritizes attempting to initiate that service, which causes the rest to slow down... Could I be right? And would anybody know what to do?

Thanks!