# [SOLVED] svchost.exe - unusual activity [ Superfetch ]



## jonf (Jul 30, 2009)

Hi,

Recently I've noticed that an instance of the process svchost.exe is eating up quite a chunk of memory (working set private) and I'm not entirely sure what for. Not that it's a problem for me, considering I have 8GB of RAM to play with, it's just a bit puzzling for me hence my curiosity as to why this happens. Please refer to the below links to some screenshots I took for reference (showing Process Explorer), with a brief explanation for each:

Screenshot 1:
This was taken just moments after logging into Windows, to show how much memory was initially being used. The instance in question is using 102,052 K.

Screenshot 2:
This was around 30 mins or so after the first screenshot, having been left idle for the entire duration. This time the same instance is using 143,712 K, which give or take a few thousand K is what it appears to settle down to after a while.

Please refer to the 'My System' link under my profile for my hardware specifications. If you want more info on the software I use please don't hesitate to ask. Hope this helps.


Regards,

Jon.


----------



## jcgriff2 (Sep 30, 2007)

*Re: svchost.exe - unusual activity*

Hi - 

SysInternals Process Explorer by Mark Russinovich, Microsoft TechNet -- Nice!

The svchost is question - PID = 1104
- 102 MB = screenshot #1 
- 144 MB = screenshot #2

Hover the mouse over the svchost in Process Explorer and you should see the list of system services appear like this - 



Now, 2x-click on the svchost 1104, click on the "services" tab and you'll see this - 



Click on sysmain - Superfetch. Then click on "Stop" - lower-right of screen.

Close the small services screen and go back to Process Explorer. What is the private pool usage for PID 1104 now?

Please note that if you have logged off/ re-booted since your screenshots, the PID will have changed. 

If I am right about the system services included in your svchost 1104, you can expect to see it increase as your logon session continues, usually capping under 200 MB.

Regards. . .

jcgriff2

.


----------



## jonf (Jul 30, 2009)

*Re: svchost.exe - unusual activity*

Hi,

Thanks for the reply. I've done as asked, and now as I write this the working set private value reads 7,556 K. Now I know what is causing it; next questions are what is it, why does it gradually take up more private pool once logged into Windows, and is it really necessary?


Regards,

Jon.


----------



## jcgriff2 (Sep 30, 2007)

*Re: svchost.exe - unusual activity*

Hi Jon. . .

Whether or not to utilize Superfetch (Prefetch in XP) is your call. It learns your program execution and file access behavior and loads the information into a "prefetch" stage.

A more comprehensive explanation can be found from Microsoft TechNet --> http://blogs.technet.com/askperf/archive/2007/03/29/windows-vista-superfetch-readyboost.aspx

I leave it running, but when I run memory dumps for BSODs and need the additional system resources as my RAM usage goes over 3 GB (4GB installed), I kill it w/ Process Explorer, just as you did.

Regards. . .

jcgriff2

.


----------



## jonf (Jul 30, 2009)

*Re: svchost.exe - unusual activity*

So this is in charge of creating a memory of which programs you've run already in order to speed up the repeat loading of said programs (e.g. web browser)? Fair enough. As aforementioned I have got 8GB of RAM to play with, so it's probably not worth me turning it off since its effect on my memory usage is virtually negligible anyway.

Thanks for the info.


Regards,

Jon.


----------



## jcgriff2 (Sep 30, 2007)

*Re: svchost.exe - unusual activity*

Hi Jon. . .

I agree. 

A drop from 144 MB to 8 MB (94% decrease) by turning off Superfetch in a system with 8 GB RAM = an overall savings of 1.6% RAM. Rather inconsequential to say the least.

Good Luck to you.

Regards. . .

jcgriff2

.


----------

