svchost.exe (netsvcs) draining all my memory

My thoughts: Disabling windows updates and running them on demand doesn't actually fix the problem. It would be better to use a machine that does what it's supposed to do. Anyway, having said that it's a decent enough workaround until you track down the culprit.

Here's a suggestion. Check for KB3038314 (windows update) and remove it if found. Your svchost problem is very likely to be related to problems with windows updates or internet explorer.

See the thread here:

What's blocking Google search from being added in IE11?

If you find the update and want to remove it using powershell refer to the screenshot here or use your own method if preferred.

https://www.sevenforums.com/attachmen...ows-update.jpg

After removal reboot and check for windows updates. Install any marked "important"

Of course if you don't have the update installed ignore this post!

"Hardware Reserved" - no idea about that. Sorry!

Re: svchost netsvcs memory leak.

Well finally fixed it but it took a couple of hours.
Edit: Actually the fix was only temporary and the problem returned after a couple of reboots. See the next post.

Briefly the steps were:

Make a system image backup (important)

Run a specific MS Fixit in aggressive mode to repair BITS and Windows Update Agent.

Reboot with no internet connection.

Run a script to register all DLL and OCX files.

Reboot.

BITS service now starts properly when called.

Disable security software that could interfere with installing windows updates.

Run a check for Windows Updates and install important & recommended updates.

Reboot.

Run another check for Windows Updates.

Reboot.

Repeat until all updates are installed.

Note: Some updates took more than one attempt to install.

Okay so the above post didn't work in the end. Tried a different approach.

Edit: Ignore the script in this post - see next post.

Ran a whole lot of commands to reset windows updates components then dicovered that the same result could be achieved by running a batch file.

Note: I still needed to run that MS Fixit that I mentioned with aggressive options then reboot before running the other repairs.

On another note: It was also neccessary to use the default windows Hosts File during repairs and not the heavily modified one that I usually use.

I can't post a link to the MS Fixit as I've only got a direct download link.

1. Run MS Fixit (aggressive option)
2. Reboot.
3. Reset Hosts.
4. Disable security software
5. Run the batch file - contents as follows:

Code:

@echo off
cls

REM ==================================================================================
REM DESCRIPTION    : This script resets all of Windows Update Agent settings.
REM AUTHOR         : Luca Fabbri
REM VERSION HISTORY: 2.0 - Start
REM ==================================================================================

@echo 1. Stopping Windows Update, BITS, Application Identity, Cryptographic Services and SMS Host Agent services...
net stop wuauserv
net stop bits
net stop appidsvc
net stop cryptsvc
net stop ccmexec

@echo 2. Checking if services were stopped successfully...
sc query wuauserv | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 goto END

sc query bits | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 goto END

sc query appidsvc | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 sc query appidsvc | findstr /I /C:"OpenService FAILED 1060"
if %errorlevel% NEQ 0 goto END

sc query cryptsvc | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 goto END

sc query ccmexec | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 sc query ccmexec | findstr /I /C:"OpenService FAILED 1060"
if %errorlevel% NEQ 0 goto END

@echo 3. Deleting AU cache folder and log file... 
del /f /q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
del /f /s /q %SystemRoot%\SoftwareDistribution\*.* 
del /f /s /q %SystemRoot%\system32\catroot2\*.*
del /f /q %SystemRoot%\WindowsUpdate.log 

REM @echo 3. Renaming AU cache folder and log file...
REM del /f /q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
REM ren %SystemRoot%\SoftwareDistribution *.bak
REM ren %SystemRoot%\system32\catroot2 *.bak
REM ren %SystemRoot%\WindowsUpdate.log *.bak

REM sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
REM sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

@echo 4. Re-registering DLL files...
cd /d %WinDir%\system32
regsvr32.exe /s atl.dll
regsvr32.exe /s urlmon.dll
regsvr32.exe /s mshtml.dll
regsvr32.exe /s shdocvw.dll
regsvr32.exe /s browseui.dll
regsvr32.exe /s jscript.dll
regsvr32.exe /s vbscript.dll
regsvr32.exe /s scrrun.dll
regsvr32.exe /s msxml.dll
regsvr32.exe /s msxml3.dll
regsvr32.exe /s msxml6.dll
regsvr32.exe /s actxprxy.dll
regsvr32.exe /s softpub.dll
regsvr32.exe /s wintrust.dll
regsvr32.exe /s dssenh.dll
regsvr32.exe /s rsaenh.dll
regsvr32.exe /s gpkcsp.dll
regsvr32.exe /s sccbase.dll
regsvr32.exe /s slbcsp.dll
regsvr32.exe /s cryptdlg.dll
regsvr32.exe /s oleaut32.dll
regsvr32.exe /s ole32.dll
regsvr32.exe /s shell32.dll
regsvr32.exe /s initpki.dll
regsvr32.exe /s wuapi.dll
regsvr32.exe /s wuaueng.dll
regsvr32.exe /s wuaueng1.dll
regsvr32.exe /s wucltui.dll
regsvr32.exe /s wups.dll
regsvr32.exe /s wups2.dll
regsvr32.exe /s wuweb.dll
regsvr32.exe /s qmgr.dll
regsvr32.exe /s qmgrprxy.dll
regsvr32.exe /s wucltux.dll
regsvr32.exe /s muweb.dll
regsvr32.exe /s wuwebv.dll

@echo 5. Removing WSUS Client Id...
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f

@echo 6. Resetting Winsock and WinHTTP Proxy...
netsh winsock reset
proxycfg.exe -d
netsh winhttp reset proxy

@echo 7. Starting SMS Host Agent, Cryptographic Services, Application Identity, BITS, Windows Update services...
net start ccmexec
net start cryptsvc
net start appidsvc
net start bits
net start wuauserv

@echo 8. Deleting all BITS jobs...
bitsadmin.exe /reset /allusers

@echo 9. Forcing AU discovery...
wuauclt /resetauthorization /detectnow

:END

6. Reboot

7. Reinstall Windows Update Agent. Can provide a link to download.

8. Reboot.

The above seems to work for me but maybe you'd get different results!

New instructions to replace those in the previous post:

Step 5 should be:

Open an Elevated Command Prompt.

Run the following.

net stop wuauserv
net stop bits
net stop appidsvc
net stop cryptsvc

del /f /q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
del /f /s /q %SystemRoot%\SoftwareDistribution\*.*
del /f /s /q %SystemRoot%\system32\catroot2\*.*
del /f /q %SystemRoot%\WindowsUpdate.log

Note: On my machine I had to force delete the four entries above using software that can force delete files/ folders. and manually search for them to confirm deletion.

Run Powershell (in Elevated Command Prompt)

Use powershell to run the following:

sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRP WPDTLOCRRC;;;PU)
REM sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRP WPDTLOCRRC;;;PU)

Exit Powershell but leave command prompt window open and run the following:

regsvr32.exe /s atl.dll
regsvr32.exe /s urlmon.dll
regsvr32.exe /s mshtml.dll
regsvr32.exe /s shdocvw.dll
regsvr32.exe /s browseui.dll
regsvr32.exe /s jscript.dll
regsvr32.exe /s vbscript.dll
regsvr32.exe /s scrrun.dll
regsvr32.exe /s msxml.dll
regsvr32.exe /s msxml3.dll
regsvr32.exe /s msxml6.dll
regsvr32.exe /s actxprxy.dll
regsvr32.exe /s softpub.dll
regsvr32.exe /s wintrust.dll
regsvr32.exe /s dssenh.dll
regsvr32.exe /s rsaenh.dll
regsvr32.exe /s gpkcsp.dll
regsvr32.exe /s sccbase.dll
regsvr32.exe /s slbcsp.dll
regsvr32.exe /s cryptdlg.dll
regsvr32.exe /s oleaut32.dll
regsvr32.exe /s ole32.dll
regsvr32.exe /s shell32.dll
regsvr32.exe /s initpki.dll
regsvr32.exe /s wuapi.dll
regsvr32.exe /s wuaueng.dll
regsvr32.exe /s wuaueng1.dll
regsvr32.exe /s wucltui.dll
regsvr32.exe /s wups.dll
regsvr32.exe /s wups2.dll
regsvr32.exe /s wuweb.dll
regsvr32.exe /s qmgr.dll
regsvr32.exe /s qmgrprxy.dll
regsvr32.exe /s wucltux.dll
regsvr32.exe /s muweb.dll
regsvr32.exe /s wuwebv.dll

Open regedit and manually delete the follwing (if found)

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f

From Elevated Command Prompt:

net start cryptsvc
net start appidsvc
net start bits
net start wuauserv

Run Powershell again (from your open Command Prompt Window)

Execute the following:

bitsadmin.exe /reset /allusers

wuauclt /resetauthorization /detectnow

Exit Powershell, Exit Command Prompt.

Reboot.

Okay so I've done some more digging and here's what I suspect.

Installing KB2990214 also installs the latest Windows Update Agent.

Quote from article linked below.

These WU [Windows Update] clients are used as part of the Windows 10 upgrade scenarios which will go live at release but are still used for down-level operating systems as the "regular" Windows Update client. This update is applicable to your systems even if you're not planning to migrate to Windows 10, so don't think you can skip it.

Microsoft elaborates on KB 2990214, KB 3044374 Win10 nagware

So having removed that update might have caused issues with Windows Update Agent on my own machine resulting in sky high svchost.exe netsvcs issues.

Anyway I've fixed it by resetting Windows Update Components and reinstalling Windows Update Agent and everything works as it should.

For now I've hidden KB2990214 and will wait to see if it's possible to install the latest Windows Update Agent using a standalone installer at some point in the future.

@guilyou

Four posts in different threads advising people to disable windows updates when experiencing problems with svchost.exe isn't helpful in my opinion. I suppose some users might like that approach.

Never turn automatic updates off. If you did just that and end up with problems, it’s your fault.

narc said:

Hi guys,
i've installed windows 7 Professional on my old laptop, but i've this problem with Windows Update, during "Check for Updates":

It does not seem normal memory usage!
Callender, you can write a step by step guide to solve it? i'm little confuse about the passages that you mentioned above.

1. Run MS Fixit (aggressive option)
where can i found a link to download it? i've found only this: https://support.microsoft.com/en-us/kb/971058

thanks

Link to MS Fixit in this thread:

Windows Update memory leak, and random CPU spikes


Write a guide? Well not really. You need to be aware that for some users the fix won't work anyway and in my case I needed to run some of the fixes a few times and reboot a few times too before the changes stuck.


Steps are:

Make a system image backup (important) so that you can restore in the event of problems.

Check for an remove this update if found: svchost.exe (netsvcs) draining all my memory

Reboot.

Reset Hosts or make sure that you're using the default hosts file during repairs.
Disable security software.

Run MS Fixit (aggressive options)

Reboot and stop Windows Update service.

Run the batch file here:

Windows Update - Reset - see option 3.

If you get problems running the batch file open an elevated command prompt and run the commands manually using Powershell in instances where you get error messages.

Reboot

Edit:

If there are still problems - Search for and remove update 3006137 using Elevated Command Prompt and Powershell.


Open an Elevated Command Prompt that should open at C:\Windows\System32

Type Powershell then press Enter.

Type the following:

get-hotfix -id KB:3006137

Press Enter and wait to see if it's found. If found type:

wusa /uninstall /KB:3006137

Press Enter. Wait for the update to uninstall.

Reboot.

Using Internet Explorer follow the instructions in this article.

http://smallbusiness.support.microso...n-us/kb/947821

Scroll down to "Download the package from Microsoft Update Catalog directly" and follow the instructions using Internet Explorer.

Then continue from where it says "For example, you may have problems when you try to install update 3006137 from Windows Update in Windows 7. In this situation, you can download the update package and try to install the update manually. To do this, follow these steps:
Open Microsoft Update Catalog in Internet Explorer."

Download update 3006137 as described and install it.

Reboot.

Note: You will see high svchost usage as file integrity checks are carried out. This could take 30 minutes or more. Once they're finished svchost usage will return to normal and Windows will check for updates. Hide any updates that you don't require and install the ones you need.

Reboot.

Change Windows Update settings to "Check for updates but let me choose whether to download and install them"