svchost.exe (netsvcs) draining all my memory

Hi everyone, first time poster, hope you can help me out. I've looked everywhere for a solution to this but so far no joy...

A few weeks ago my computer started randomly slowing down and freezing. No hardware/software changes. I checked on Resource Monitor and found svchost.exe (netsvcs) gradually start to eat up memory after startup. I also noticed that the "Hardware Reserved" portion of my memory was suspiciously huge (2GB out of 4 total).

I thought I had a solution when I uninstalled a cheap Belkin USB wifi adapter that I had been using, and plugged in cabled internet instead. The Hardware Reserved dropped to a more reasonable 556 MB and the computer worked normally for a few days. But now I have restarted again and the problem is back. Done full scans with Kaspersky and Malware-Bytes = nothing. I also downloaded and ran CPU-Z and it came up with a error message on startup. I will attach that, along with screens from resource monitor.

Right now I'm running just fine as long as I'm not connected to the internet. We'll see if I can get online long enough to post this...

If anyone can help, please let me know!

That hardware reserved seems too much, just checked mine and it is at 4MB. Hopefully, someone more knowledgable will reply.

Hmm, some googling, it may be your integrated GPU's dedicated memory. Check in BIOS and change it to see if it changes the hardware reserved amount.

Also from another thread:

snoozemode said:

Activate memory hole remapping in BIOS and you will get your "harware reserved" memory back.

Thanks for the suggestion GokAy - I'm not sure how to change my GPU's dedicated memory, but I will look into it.

That doesn't account for the memory being gobbled by svchost though. I feel like they're connected in some way. My hardware reserved has flip flopped between 556 MB and 2604 MB, both of which seem huge. My work computer and laptop both have 100 MB or less reserved. My research mostly came up with people who have recently upgraded their RAM, but I haven't made any hardware changes at all (besides removing that USB wifi adapter to try to fix it).

The memory leak for svchost is the real problem though - the change in hardware reserved just means it takes longer for it to freeze up my system.

Any help is appreciated!

I've included a snip of my resmon with the hardware reserved at 2604 MB, before svchost ate up the remaining...

Hey, maybe you can try this: make sure you backup, system restore point etc

Last post - svchost.exe (netsvcs) using 80% of ram and most of my cpu - Page 2 - Tech Support Guy

"Hey guys, i too had this problem, i did consult various forums before ending up on microsoft support agents, i got the information that this was indeed a known bug that bundled itself up on windows 7 and probably 8 win(management) framework 3.0 & ^ update and involves handle leakages{ more casual : resource/memory leakage} so that this "super process" svchost(ntsvc) only acquires memory and fails to let go once done using it, there is presently a fix to this issue inform of a hotfix that you download and install onto your computer, it did help but afterwards you gotta be careful with you updates or the bug will show up again.

have a look at this link : microsoft community.
https://support.microsoft.com/en-us/kb/2889748

I did risk applying the hotfix because they said it should only be applied by those who are greatly affected by the bug, it worked like a charm and now this "process" only uses {3-5}% of my R.A.M while previously it could use upto 70% memory."

Thanks, that definitely sounds like what I'm dealing with!

I will give it a try.

I tried the hotfix but it says it's not applicable to my computer. I checked through Windows Update and I haven't installed the update for Windows Management Framework 3.0 (update 2506143), so I don't think this is the fix I need.

I'm finding it tough to diagnose because as soon as svchost starts grabbing memory it goes pretty quickly, so I can't get an idea of what's taking the memory before everything freezes completely.

Oh well, it was worth the try.

From what I have read they were talking about Windows Update and background intelligent transfer service (BITS) is causing this behavior. At least for some people.

Now I don't advice turning Windows Update off as a solution but you might temporarily disable it and see if the problem continues. Just restart windows afterwards.

Not sure if BITS will start with WU off. If it does start and the problem arise again, you can temporarily change the service to Disabled (should be Manual atm) and see if stops the memory problem.

So, 2 things to try for you! :)

Hello!

I had the same issue and I put a little time to solve it. :)
The svchost service in question is a Windows service host that contains lots of services, it must be done so that you get into it ... Like you, for almost 10 minutes after the computer has started, I couldn't do almost anything...
Then I get the idea "services.msc" (you type that in the Run bar) : there are there full of services that consume a max of memory and are not necessarily always helpful, it depends on your use your desktop.
The main culprit turns out to be the Windows Update service and its two acolytes : the Security Center service and the Windows Modules Installer.

If you have a correct antivirus, you do not need to search for the Windows updates at each startup.
Personally, since I disabled all three services, I haven't the problem at all any more ; I just reactivate the Update service once a month, at night.

Here's the trick :
- In the Window's path (type set path in a prompt window), create a command file "wud.cmd" (wud like Windows UpDate but you can choose any other name) containing the following code:

@echo off
rem script d'activation/désactivation des services liés à W Update
if "%1"=="" (
echo activation service Centre de securite
sc config wscsvc start= demand
sc start wscsvc
echo activation Programme d'installation pour les modules Windows
sc config TrustedInstaller start= demand
sc start TrustedInstaller
echo activation service Windows Update
sc config wuauserv start= demand
sc start wuauserv
call :verif
call :verif
) else (
echo desactivation service Windows Update
sc stop wuauserv
echo desactivation Programme d'installation pour les modules Windows
sc stop TrustedInstaller
echo desactivation service Centre de securite
sc stop wscsvc
call :verif
call :verif
sc config wuauserv start= disabled
sc config TrustedInstaller start= disabled
sc config wscsvc start= disabled
)
pause
goto :eof
:verif
timeout /T 10
sc query wuauserv
sc query TrustedInstaller
sc query wscsvc
goto :eof

Here it is !

- Now you just need to open a command prompt window as administrator and to type:

wud d

(d like disable)

And it's good! The concerned services are disabled and let you easy.

- Then, every month, in a command prompt as administrator, type "wud" without any argument. This reactivates Windows Update service, and allows you to make updates. If necessary, schedule a task to remind you.

What a relief, I was also wondering how to get out but this little trick is enough and tested OK !

Regards,

Guilyou