svchost.exe processes chewing up RAM

I've noticed that if I don't shut down my computer for a while, I get an accumulation of svchost.exe processes, and they're chewing up my RAM. I've Googled this problem but all I got was really lengthy explanations about how svchost processes work, or paranoid people telling everyone it's probably a virus/malware. Ending the svchost processes is a short term fix but since svchosts also apparently support OS stuff it's not a wise move. I've found up to 12 svchost processes running at once, and yesterday I'd closed everything except things like steam, MSN, anti-malware programs, and still had a bunch of svchost processes taking up about 170mb of RAM.

Can someone tell me what you would do if you found a lot of svchost processes running on your machine?

The easiest way to think of them is the middleman between the program you're running and the DLL it's loading. Generally speaking, you have so many of them because just about everything these days requires DLL's to run.
Generally speaking if you have a virus, and it has an infected DLL file (usually one that's called on in the registry) it'll have an SVCHost.exe attributed to it.

What you want to look for is what's using it. Most likely by the sound of it, it's a torrent application of some kind. The best option is to quit that program and reboot it. Many free programs are not exactly coded efficiently (hell, most large programs aren't either). so sometimes like many torrent apps, they'll keep a running record in the memory, which builds up, and chew up the memory.
I used to have the same trouble with larger files after running continuously for six days.

Windows 7? Right click on svchost.exe in task manager and select 'go to service(s)'. That'll redirect you to the services tab and highlight the services attached to that instance of svchost.exe

alternatively, open a command prompt and type:

tasklist /svc

also, kagetsu is wrong. svchost.exe is used when the dll IS the program - such as services.

(ie, svchost = servicehost)

when a program requires a dll the dll is loaded directly by the program without using a middleman.

currently, i have an svchost process running that uses 188mb of ram, and it is running about 8 different services all related to windows drivers.

I'm running Vista 64 bit. I might just post a hijackthis log on bleepingcomputer.com or whatever the website is where they analyse it, because when I read about finding what services are using svchost it sounded pretty complicated. I use Frostwire (rarely use utorrent or any other clients) but I always quit it from the system tray when I'm done coz it irritates the **** out of me when programs sit down there after you've closed the window. I suppose Frostwire could still be the culprit but I guess a HJT log will eliminate other sources first.

Even if I find out what services are using the svchosts, it's still a bit tedious to have to find out what they are and then close them. I take it there's no other way of controlling the svchost situation, just put it down to poor coding practises?

...

it has nothing to do with your damn torrent application unless your torrent application runs as a service.

if the loss of ram bothers you, find the services and disable them. alternatively, reboot. alternatively, buy more ram.

what's complicated about right clicking on something and hitting 'go to services' ?

Quote from paladin;371350:
it has nothing to do with your damn torrent application unless your torrent application runs as a service.I wouldn't have a clue if my torrent application is running as a service, otherwise I wouldn't be posting about services and svchosts here. I was simply going on Kagetsu's advice.

Quote:
if the loss of ram bothers you, find the services and disable them. alternatively, reboot. alternatively, buy more ram.

what's complicated about right clicking on something and hitting 'go to services' ?Well, since you asked if I had Windows 7, and I don't, I assumed that feature is only in Windows 7. I'm at work now, running XP, so I can't try it myself.

Quote from paladin;371350:
...

it has nothing to do with your damn torrent application unless your torrent application runs as a service.

if the loss of ram bothers you, find the services and disable them. alternatively, reboot. alternatively, buy more ram.

what's complicated about right clicking on something and hitting 'go to services' ?

You're right Paladin... But doesn't pretty much all torrent applications use A service of some variety?

the tasklist command will still work, at the very least.

you can cross reference the results with your services list to find out what they do exactly, or google each one of them if you dont trust that.

Quote from paladin;371344:

alternatively, open a command prompt and type:

tasklist /svc

That is so cool. Thanks for the tip paladin. That's 2 posts today that I have enjoyed from you :)

Quote from Kagetsu;371363:
You're right Paladin... But doesn't pretty much all torrent applications use A service of some variety?

they'd make use of them, (everything does) but most torrent applications themselves wouldnt be services.

i suspect there are some that are however.

svchost.exe 928 DcomLaunch, PlugPlay

svchost.exe 984 RpcSs

svchost.exe 1032 WinDefend

svchost.exe 1080 Audiosrv, Dhcp, Eventlog, lmhosts

svchost.exe 1112 AudioEndpointBuilder, CscService, EMDMgmt,
hidserv, Netman, PcaSvc, SysMain,
TabletInputService, TrkWks, UxSms,
WdiSystemHost, Wlansvc, WPDBusEnum, wudfsvc

svchost.exe 1140 AeLookupSvc, BITS, Browser, CertPropSvc,
EapHost, gpsvc, IKEEXT, iphlpsvc,
LanmanServer, MMCSS, ProfSvc, RasMan,
Schedule, seclogon, SENS, ShellHWDetection,
Themes, Winmgmt

svchost.exe 1376 EventSystem, fdPHost, FDResPub,
LanmanWorkstation, netprofm, nsi, SCardSvr,
SSDPSRV, SstpSvc, upnphost, W32Time,
wcncsvc, WebClient

svchost.exe 1576 CryptSvc, Dnscache, KtmRm, NlaSvc, TapiSrv,
TermService