svchost.exe using almost all available random access memory after boot

TheDeerDude · 07 Mar 2015

Hello, I will start by describing the problem:
Whenever I start up this laptop, usually after opening Firefox I find that it keeps freezing by even hovering the mouse cursor over links, or UI elements. It turns out that the problem is an "svchost.exe" process that takes up to 800MB of my ram (out of 2GB) which is all I have available for programs. Other than that, it does have slight CPU usage - 5 - 15%. After about 20 minutes, the process calms down. This has happened three times just after booting so far (every time I booted this machine).

Here is some information about the machine itself:
Manufacturer & Model: Hewlett Packard Compaq Presario CQ70-211EM
Type: Laptop
Detailed specifications: Contact HP Support and Customer Service | HP® Support
OS: Windows 7 Home Premium x64

Some more information about what I did to the machine:
I erased the hard drive using DBAN in auto mode. Then, I re-installed Windows and installed all the necessary drivers. After doing so, I have installed all the "important" and "recommended" updates for Windows, except a few I didn't need. After installing and configuring some of my favourite programs that I would be using, this is where svchost really ruined my good mood.

I did scan the system with Malwarebytes after installing all the drivers and Firefox, in safe mode. I haven't downloaded or installed anything that could come with viruses/spyware. Everything was scanned ahead of opening it, and I haven't even plugged any drive I haven't checked to this machine.

This has happened before to me, on another machine and on my friend's computer. Apparently it's a normal thing that some service does, after installing the OS. Can't remember what it was though.

I was not installing any updates at the time it happened.

Screenshots:
I have included three screenshots. I couldn't quite capture it in Process Explorer when it was using 500MB+ RAM because it was too slow, I wasn't able to open it (PE) until it calmed down slightly.
- svchost shown in task manager using 500MB+ RAM
- same process and its services shown in Process Explorer (top of the list svchost screenshot)
- second svchost process and its services

I would want to avoid running anti-virus scans or installing any other programs for now, until all the less disruptive and intrusive solutions/troubleshooting methods have been suggested and applied.

I appreciate any help and replies I get, thank you.

TheDeerDude · 08 Mar 2015

Update:
Same thing happened again this morning, after boot. Very, extremely frustrating. svchost was using over 800MB of my ram, leaving about 300MB for all other applications I had opened, including Firefox, which made everything not responding.

I've managed to capture it and its services when it was at about 700MB+ in Process Explorer, as I was writing this just now. I've also included a screenshot of the same process, after it calmed down.

Strangely enough, the first time it happened today I've switched off the wifi - it stopped after a while, after I've switched it back on, after a moment the process was eating all my RAM again, and after it stopped, it did it again as I was writing this post. Ugh.

1 - svchost using all RAM
2 - calmed down slightly
3 - after a few minutes (3-5)

Update: It happened randomly as I was watching videos on youtube, made everything not responding for 15 minutes, I could not do anything, everything froze because svchost used all RAM

TheDeerDude · 11 Mar 2015

It keeps happening, up to 5 times daily. svchost uses ALL RAM and CPU. It completely freezes the machine for 10-15 minutes. I can't describe how frustrating it is. And it happens randomly too.

I'm helpless. I've disabled windows update service and superfetch hoping one of these might be the issue - but no. I've never had this happen to be before, when I used to install windows and windows only without ever updating it.

Microsoft windows update - it's more likely to wreck your computer and make it unusable rather than "fix" things. Microsoft never does anything right.

Callender · 11 Mar 2015

Your screenshots all show windows updates service is running. Are you sure that you disabled it?

TheDeerDude · 12 Mar 2015

Of course, I disabled it after I posted these, after doing some research

Callender · 12 Mar 2015

Okay well I suspected a problem with Windows Updates but if you disabled it then it would appear to rule it out as the cause.

Callender · 14 Mar 2015

Well I just experienced a similar problem. Ran my usual tools to fix and repair windows updates and the issue persisted. Also I keep system restore disabled but had reason to enable it just for test purposes when using software that can mount and browse system restore points. When I enabled system restore on my windows partition I unexpectedly got a message saying that windows detected pending updates and would I like to apply them? So I let it go ahead only to find that on reboot - updates failed and changes were rolled back.

My thoughts:

The latest round of updates replaced tons of system files including rstrui.exe (system restore) and patched IE against the Freak attack. On my machine I keep IE disabled by means of a registry hack and also keep system restore disabled. I wondered if this might have caused problems with the latest updates.

Action taken:

Rolled back to a system image backup made before the lastest windows updates were installed. Disconnected network adapter. Re-enabled IE and system restore. Re-enabled network adapter and rebooted. Downloaded and installed windows updates and everything works. No more svchost or wuauserv problems. No pending or failed updates. Everything works.

Suggestion: Ask in the Windows Updates & Activation section if there's anything you can do to check for pending updates that haven't been applied or if there are any other suggestions.

TheDeerDude · 15 Mar 2015

Hello again and excuse me for getting back to you late.

My issue seems to have calmed down for now, although I've been using a different machine because of this problem. I shall post in the other forum section on here (the one you mentioned) if the problem persists.

So far - so good, thank you for help

perrymc · 29 Jun 2015

Win 7 Home Premium on an HP Compaq Presario CQ5300F

I have been experiencing the same problem of high mem/cpu usage. Perhaps my experience will help someone find a solution where I cannot. Mine goes to 100% and stays there. It started randomly months ago but steadily got worse. For me the problem centers on SvcHost which seems to be waiting on a process within LocalService&NoImpersonation. It does have a PID but the Thread has no number, just a dash.

I have not been able to determine exactly which process is actually hanging. Stopping processes one at a time within the group did not resolve the issue. I really thought I was looking at a hardware problem but all my HP diagnostics and mem tests came back clean including stress tests multiple times. Cleaning the hardware, reseating memory etc made no difference.

I finally gave up and chose to do a System Recovery and start over. I thought I would start small with just basic installation of software I use and only do updates one at a time until I saw a change. Considering my system is from around 2010 or so, I knew I would literally have hundreds of updates to wade through with no idea what order to accept or decline them to get back up to speed. I just started with them as Updates presented them to me.

I only had about thirty or so installed when Win 7 Service Pack 1 came up. I started having the problem within an hour after installing the Pack. I did a system restore to remove it and the problem is once again gone. Wow! Not prepared for this.

Not sure where to go from here but I will keep working it .... or just get a new Win 10 system in a couple of months!

Callender · 29 Jun 2015

Some users have aslo reported resorting to a clean install of winows only to encounter the same problem. At the moment it seems that for me at least the fixes I posted work and if I do subsequently encounter high RAM usage by svchost for a brief period then deleting %WinDir%\SoftwareDistribution\DataStore\Logs\* seems to release memory. Since I don't understand why - I don't advise that it is a fix. It might help someone with a little more knowledge get to work out what causes the memory leak.