svchost.exe (netsvcs) draining all my memory

Thanks. The issue no doubt rolled in on an update whenever it is not a malware. The question is which component, and which set of hardware. If I can narrow that down I can do more verbose logging to figure out why. At the least, if updates are removed, in theory, the problem will be too (given that all 'installed' components through updates are removed).

I have found reports of 100+ systems of the same kind (companies etc) coming across this issue over night. Thing is too if it persists, Microsoft will out out the patch in another months updates...

Nedly said:

Can we check this on the infected computers? -- I am still working on setting up a system so I am not up to par yet. If this update is installed, I would wonder if removing this specific update for a test would yield results...

https://support.microsoft.com/en-us/kb/3050265

My other theory: when I look at updates available now compared to what updates were available "#" long ago, there is a differentiation. I think it is possible that Microsoft bundled up some of their older updates and changed things a bit. How easy would it be to remove all of the installed updates in a PC? - , and then scan for new updates -- reinstall.

I am going through various updates now, I will post as soon as I have some leads.

@nedly, I assure you that I have eliminated the possiblity of a virus. The svchost that is running in not a copy and it resides in the correct directory and all that good stuff. As far as removing all updates man it takes forever to add them all back in, been there done that too many time before.
The biggest problem I have in trying to figure out which of the processes is comsuming the memory. All I know is it is one of the services that svchost starts that has the nsi service. There are 8 services that spawn for this one svchost process, the one I think it is is the NSI service. If someone can tell me how to get the memory usage for a single running service please tell me, that way I can at least figure out which service is running amuck. Whatsrunning 3 (beta) does not give a memory per service usage at least not that I can tell.

Have you checked your update log? I would like to check that out if possible so I may compare. Some of these machines I have here are being difficult with creating the issue. You can click start | type: run | type: windowsupdate.log

Once in notepad, you can do Edit: search, type in 'svc' and search through the ties and processes...

ripsw said:

The biggest problem I have in trying to figure out which of the processes is comsuming the memory. All I know is it is one of the services that svchost starts that has the nsi service. There are 8 services that spawn for this one svchost process, the one I think it is is the NSI service. If someone can tell me how to get the memory usage for a single running service please tell me, that way I can at least figure out which service is running amuck. Whatsrunning 3 (beta) does not give a memory per service usage at least not that I can tell.

This will be difficult without trial and error if it is a memory leak, because the glitch nature of a memory leak will not properly log the process. This is why it seems to be 'hidden' or make no sense, it is a spill quite literally.

Right now we need to figure out how to reverse specific components in suspicion to figure out which one is in conflict. If you have a specific service in mind, we need to find the updates related to that service and then remove it in hopes that one we find will be it.

My gut says it's the nsi service. Problem is if you disable it most of anything to do with networking won't work.

If you want, I have the virtual machine up, I will try disabling that service and log the process to see what happens. I know it will kick you off the network but it might not be bad enough to run a test with it.

You can stop it, and you will lose your network, but quickly after you stop it some other service relaunches it. At this point the network services that you need to connect are 50/50 running and not. For now you could run this process - while logging your resources - to see if there is a moment while the services are stopped that your memory drops.

It is easy to get back on, mine gathered its services after poking in the network section of the control panel. The services resolved themselves before I could troubleshoot. You can set default launch to disable manual etc it is persistent.

The only thing in my update log was windows defender updates, I thought I had turned that off as well but missed it. It is now off.

Callender said:

Hey - it seems that utilities only report memory usage for svchost and not the services running under it. If you are sure that there are no critical services running try stopping one rather than setting it to disabled. Give me a minute and I'll try stopping and restarting NSI service and see what happens.

System won't let you stop the nsi service, tried that