svchost and MsMpEng

Collarspace Discussion Forums

Home Login Search

svchost and MsMpEng

View related threads: (in this forum | in all forums)

Logged in as: Guest

All Forums >> [Casual Banter] >> Off the Grid >> svchost and MsMpEng

Page: [1]

Message

<< Older Topic Newer Topic >>

svchost and MsMpEng - 8/17/2015 1:46:37 AM

kkaliforniaa

Posts: 263
Joined: 3/10/2007
Status: offline

Hiya. Yes, I know this isn't some technical support website, but I don't want to create an account at every single website in the entire known universe only to post one comment. One would think that websites like Microsoft might have features where you could comment as a guest, if you wanted to post in their forums, in an attempt at seeking a solution to the problem.. Plus, I'm sure there are at least a handful of people on here who experience the same problems I've had.

Okay, now for the nitty gritty..
Problem: Around 2am [New York time], EVERY day, svchost.exe starts "overreacting" [lasting for 1-2 hours, and it can lather, rinse, repeat itself 2-3 times a day]. It can reach memory usage of 650,000 [I'm sure if I had fewer programs open, it would get higher], sending the Physical Memory to 97%!! [I think that has been the highest, but I don't keep track]. 650,000 memory is the equivalent [I think] of playing 2-3 videos at hulu at the same time.. I recently determined [I think I'm right about this], that the problem is a result of Microsoft Security Essentials performing updates, because when I right clicked on svchost, went to services, the following were listed

wuauserv MMCSS
Winmgmt LanmanServer
Themes iphlpsvc
ShellHWDet... IKEEXT
SENS gpsvc
seclogon Browser
Schedule BITS
RasMan Appinfo
ProfSvc AeLookupSvc
[the list above is supposed to be two columns, but when I previewed this post, the 10 spaces I had between "words" had disappeared, hence using different colors]

and wuauserv is linked to Microsoft Security Essentials [with schedules starting around the same time my computer starts PMSing].. So, I did some Google searches, and there were forums regarding this problem at Microsoft [refer to what I said earlier, now it makes a little more sense, doesn't it *hehe*].. The solution the Community Moderators [I think that was what they were listed as] had, was to remove all security software, except for Microsoft Security Essentials.. Now, the reason I am here, asking this, would you [anyone who is tech savvy] recommend the same thing? Having Microsoft Security Essentials [and Windows Firewall] as the only security software on your computer? Or, would you recommend using Norton, McAfee, etc? For me, I have Norton on my computer along with Microsoft Security Essentials, but lately I keep getting pop-ups from Norton saying something along the lines of

**Warning** Conflicting software.
Remove Microsoft Security Essentials.
[Yes] [No]

I have used AVG [free] [and another free anti-Malware program] [on other computers], but.. They didn't do anything to protect my computer, and I got viruses/malware.. Someone installed Malwarebytes Anti-Malware [from cnet], and every time my computer reloads, I get a pop-up about how it wasn't installed properly or something like that. Needless to say, while Norton may suck, it can be reliable. Plus, unlike Microsoft Security Essentials, the user can schedule when updates [and scans are performed. You can even start a scan before you go to bed!! Imagine that!!]

oOo In the midst of svchost "overreacting", MsMpEng decides it wants to join in on the fun as well, and reaches memory usage of 325,000 [svchost receeds, using only around 225,000 memory]!.. For this to happen EVERY day, it gets a bit tiresome, especially when you're trying to 1. get work done 2. relax and play computer games or watch videos online.

Thoughts. Opinions. Please and thank you!

Profile

Post #: 1

RE: svchost and MsMpEng - 8/17/2015 8:03:37 AM

Zonie63

Posts: 2826
Joined: 4/25/2011
From: The Old Pueblo
Status: offline

I've found that Windows Update is quite a culprit in periodically causing the computer to kick into overdrive.

(in reply to kkaliforniaa)

Profile

Post #: 2

RE: svchost and MsMpEng - 8/17/2015 3:06:06 PM

MercTech

Posts: 3706
Joined: 7/4/2006
Status: offline

A> Do you have indexing turned on? That can cause some serious problems as it wants to re-index way too often.

B> I actually consider Norton some of the most serious malware out there. It breaks the installation of too many programs that are productive.

I use AVG, the full package not the free version. And AVG PC Tuneup is worth the price just for the ability to fine tune your startup services alone.

(in reply to Zonie63)

Profile

Post #: 3

RE: svchost and MsMpEng - 8/20/2015 11:43:34 PM

kkaliforniaa

Posts: 263
Joined: 3/10/2007
Status: offline

a. I don't know what indexing is, but I think I said that I had looked in to what the processes and services were, and there was a forum that talked all about Microsoft Security Essentials.. It is possible that there are multiple culprits.. What is indexing exactly? If it's a process that only starts when the computer has been idle for many minutes, then I'm going to have to go with "no" on that, because busy or not, svchost and those processes/services start PMSing at the same time every day.. I'd imagine indexing could be arranged to start only after the computer has been idle for ## minutes and or at a certain time.

*MpSigStub should be included in the list of processes that PMS for what seems like no real reason.

< Message edited by kkaliforniaa -- 8/21/2015 12:30:47 AM >

(in reply to MercTech)

Profile

Post #: 4

RE: svchost and MsMpEng - 9/9/2015 6:40:35 PM

kkaliforniaa

Posts: 263
Joined: 3/10/2007
Status: offline

Just an update.. I went in to resource monitor [from Windows Task Manager], sorted the Memory menu in order from highest to lowest. It seems like the svchost that is eating memory is svchost.exe (netsvcs). What that means, I don't know.

(in reply to kkaliforniaa)

Profile

Post #: 5

RE: svchost and MsMpEng - 9/10/2015 7:40:46 PM

CarpeComa

Posts: 194
Joined: 5/12/2010
Status: offline

2 minutes searching "netsvcs" on google:

The link

quote:

Hey, maybe you can try this: make sure you backup, system restore point etc

Last post - svchost.exe (netsvcs) using 80% of ram and most of my cpu - Page 2 - Tech Support Guy

"Hey guys, i too had this problem, i did consult various forums before ending up on microsoft support agents, i got the information that this was indeed a known bug that bundled itself up on windows 7 and probably 8 win(management) framework 3.0 & ^ update and involves handle leakages{ more casual : resource/memory leakage} so that this "super process" svchost(ntsvc) only acquires memory and fails to let go once done using it, there is presently a fix to this issue inform of a hotfix that you download and install onto your computer, it did help but afterwards you gotta be careful with you updates or the bug will show up again.

have a look at this link : microsoft community.
https://support.microsoft.com/en-us/kb/2889748

I did risk applying the hotfix because they said it should only be applied by those who are greatly affected by the bug, it worked like a charm and now this "process" only uses {3-5}% of my R.A.M while previously it could use upto 70% memory."

2nd link from a google search for "msmpeng"

quote:

As this issue is very common with OneCare and Windows Defender, I think the principle is the same. The MSMPENG.EXE may consume memory and CPU when a scan is running. Meanwhile, this issue may also occur when there is a conflict with other process or service.

As FCS client leverages Automatic Update service, there is known issue for high CPU issue. You may have known it:

http://support.microsoft.com/kb/927891/en-us

We suggest to install this update to all client machines to avoid hitting this possible high cpu issue.

quote:

Based on my experience, MSMPENG is the antimalware detection engine shared by OneCare and Windows Defender. If MSMPENG.EXE is constantly consuming excessive memory and CPU, there is a conflict on your PC with another process or service. I would recommend disabling all startup items via MSCONFIG. If the problem goes away, enable startup items one at a time until the conflict is identified.

When the scanning is ended, your machine won’t have this MsMpEng.exe running, waiting for the next Quick Scan. You can do the following:

1) Immediately stop the scan by calling Windows Defender and stopping it.

2) Remove schedule scan form Windows Defender in Options. Recommendation is to keep it on schedule.

3) Change hour of this scheduled scanning to a more convenient for your activities, for instance during your lunch times.

So in short: looks like it might be an auto-update issue or some anti-virus scan from OneCare/Windows Defender, or both at the same time. Updates are available. Combining AVG Free and MalwareBytes is usually more than sufficient. No anti-virus is perfect as every company is always playing catch-up.

(in reply to kkaliforniaa)

Profile

Post #: 6

RE: svchost and MsMpEng - 9/12/2015 2:25:40 PM

DesFIP

Posts: 25191
Joined: 11/25/2007
From: Apple County NY
Status: offline

The Man has windows 7 and complains about this. I will give him the link, hopefully it will fix the problems.
Thanks.

_____________________________

Slave to laundry

Cynical and proud of it!

(in reply to CarpeComa)

Profile

Post #: 7

RE: svchost and MsMpEng - 9/12/2015 2:57:11 PM

dcnovice

Posts: 37282
Joined: 8/2/2006
Status: offline

quote:

I actually consider Norton some of the most serious malware out there. It breaks the installation of too many programs that are productive.

It came with my craptop and keeps badgering me about renewing my subscription.

Is there a safe way for a non-tech-type to remove it?

_____________________________

No matter how cynical you become,
it's never enough to keep up.

JANE WAGNER, THE SEARCH FOR SIGNS OF
INTELLIGENT LIFE IN THE UNIVERSE

(in reply to MercTech)

Profile

Post #: 8

RE: svchost and MsMpEng - 9/12/2015 3:29:52 PM

freedomdwarf1

Posts: 6845
Joined: 10/23/2012
Status: offline

I have never suffered this problem on any of my machines here.
Some are towers, some are laptops, a mixture of different vendors and a mix of XP (Pro) and/or Windows7 Ultimate (some are dual-boot).
In all, there are about 19 machines plugged in via the LAN and about 8 or 9 various tablets and phones using the WiFi link.

The common thing with them all is this -
Never do Ms auto-updates, ever.
All use Malwarebytes Antimalware Pro and Anti-exploit Premium.
None of them ever use toolbars in the browsers.
We don't use Opera or Google Chrome or anything other than IE or FF.
All use Ms Defender (or for XP systems, Ms Security Essentials).
Many AV and security software will not behave nicely when used with other security stuff - most of those on the market really go screwball or won't even install properly if there is other security stuff running. So for that reason, I don't have any other security or AV software installed on any of them.
I always configure Windows defender (or MSE) to use only 50% CPU and only run when the machine is not busy. Same for Malwarebytes.
I set it to scan at 3am every day and I always check for updates daily when the machine isn't too busy.

I haven't had malware, spyware, viruses, hi-jacks or anything nasty in many many years.
About once a week I grab various online scans to double-check that my security is working Ok.
I also defrag and run some free software called 'freefixer portable' to rake out extraneous registry entries and possible unwanted start-up processes.
Our internet is only 10Mb and we don't suffer lags or slow access unless someone hammers it downloading huge game updates (World of Tanks etc) or movies.

The only other active choice I've made is to ban FB from all machines on the LAN (added it in the HOSTS file) and to stop streaming from YT.
If FB is that desperate, use it on a smart phone via the WiFi.
If there is something anyone wants to watch, download it first and watch it offline.

So far, everything is good.
Scans always come back clean.
No nasties, no hiccups, no lags.
Every machine runs as smooth as silk no matter what they are doing (Minecraft is the latest craze here).

Dunno if that helps but it's working very well here.

ETA: average CPU usage is usually around 1-2%. Average Ram used is rarely above 60% and some of these machines have stupidly small Ram installed (less than 1GB) and slow processors.

< Message edited by freedomdwarf1 -- 9/12/2015 3:35:41 PM >

_____________________________

“If liberty means anything at all, it means the right to tell people what they do not want to hear.”

George Orwell, 1903-1950

(in reply to kkaliforniaa)

Profile

Post #: 9

RE: svchost and MsMpEng - 9/12/2015 5:09:47 PM

angelikaJ

Posts: 8641
Joined: 6/22/2007
Status: offline

quote:

ORIGINAL: dcnovice

quote:

I actually consider Norton some of the most serious malware out there. It breaks the installation of too many programs that are productive.

It came with my craptop and keeps badgering me about renewing my subscription.

Is there a safe way for a non-tech-type to remove it?

I sent you a PM, dc.

_____________________________

The original home of the caffeinated psychotic hair pixies.
(as deemed by He who owns me)

http://www.collarchat.com/m_3234821/tm.htm

30 fluffy points!

https://www.youtube.com/watch?v=mQjuCQd01sg

(in reply to dcnovice)

Profile

Post #: 10

RE: svchost and MsMpEng - 9/12/2015 6:15:57 PM

dcnovice

Posts: 37282
Joined: 8/2/2006
Status: offline

quote:

I sent you a PM, dc.

Many thanks!

_____________________________

No matter how cynical you become,
it's never enough to keep up.

JANE WAGNER, THE SEARCH FOR SIGNS OF
INTELLIGENT LIFE IN THE UNIVERSE

(in reply to angelikaJ)

Profile

Post #: 11

RE: svchost and MsMpEng - 9/18/2015 3:06:15 AM

MatureSpaiosexul

Posts: 30
Joined: 8/6/2015
Status: offline

Just made me glad I don't do Windows. ;-)

Luddites like myslef use Macs, badly but in blissful ignorance.

_____________________________

He who rules, truly serves
She who serves truly rules
Power flows in partnership

(in reply to dcnovice)

Profile

Post #: 12

RE: svchost and MsMpEng - 9/18/2015 7:42:18 AM

mnottertail

Posts: 60698
Joined: 11/3/2004
Status: offline

svchost is middleware by "application" or "system" that fetches and runs service programs ((dll) to some of you) for the main application. You will probably see a stack of svchost programs running at any time. So when you see the mem usage go up on that see what else is running up mem usage.

(I would check your task scheduler to see what you are running at 2 am or whatever it is daily) might be your norton update yeah, norton, semantic, mcafee that stuff is junk, you only want one program running security, microsoft sucks, turn it off, the others mentioned suck too, but there are pretty good free ones out there.

< Message edited by mnottertail -- 9/18/2015 7:43:09 AM >

_____________________________

Have they not divided the prey; to every man a damsel or two? Judges 5:30

(in reply to MatureSpaiosexul)

Profile

Post #: 13