svchost.exe (Local Service) eating my RAM!

MrDuck · 27 Oct 2015

Well I tried using RAMMap and my results are attached. But I'm not clear what they may mean. Right nor svchost.exe (LocalService) has crept up to 498MB after about 30 hours since rebooting, and growth is accelerating (it's some sort of exponential process).

I've tried disabling the Dell utilities bit this made no difference and virtually all that is left is Microsoft stuff. Can there be threads though which are kicked off from within the Registry that don't show in the Services or Startup tabs of msconfig?

I haven't tried the Hot Fix yet, but I guess I could if I made a restore Point first in case it goes wrong!

Callender · 27 Oct 2015

Okay you've got a new problem with a different service. It's is not the same instance of svchost running the same services as shown in your original post.

Now you have a problem with windows updates and svchost.exe (netsvcs)

If you right click on the problematic svchost in task manager and hover over "Go to service you should see "windows update" listed as one of the services.

The fix for that is not easy at all although you might see some menbers posting a solution where installing a certain version of Windows Update client worked for them. Really it requires a full removal of all versions of Windows Update Client followed by a manual cleanup of certain files and folders, running a few command lines and running advanced disk cleanup (including windows updates cleanup) and even then you might need to run through the fixes a few times and it can be hard to sort out.

I know this because I had the same problem several times over the last 6 months and each time I fixed it the problem eventually returned. Currently my machine runs okay averaging about 1.7GB RAM usage rising to a maximum of 2.2GB when runiing a windows update check.

Note: Your peak usaage indicates a problem reads/ writes to datastore.edb which is used when checking for windows updates. I do not see any driver problem when I look at your screenshots.

EDIT:

Okay ignore the above as it is not correct. Please post a screenshot like the one you posted here:

But sort by "Active" tab (higheset to lowest) when you experience the high RAM usage issue so we can see what is at the top of the list. Thanks.

MrDuck · 28 Oct 2015

Thanks for your continued interest. I think this is what you are after...

svchosts.exe (LocalService) now up to 768Mb!

Callender · 28 Oct 2015

Okay thanks. Your screenshot doesn't show the problem that I suspected you might have. I noticed from your earlier screenshot that the most unusual thing that stands out is your "paged pool" memory usage. It does look way too high. How to track down the culprit and fix it isn't something that I am able to deal with but maybe it will give other members some ideas.

Also "Process Private" seems to be a little on the high side so what do you see if you switch to the "Processes" tab and sort by "Private" - highest to lowest.

For comparison screenshots from my machine.

svchost.exe (Local Service) eating my RAM!-rammap1.jpg

svchost.exe (Local Service) eating my RAM!-rammap2.jpg

Also can you state which services are running under your problematic svchost instance?

MrDuck · 28 Oct 2015

Thanks for the note Callender. but please could you remind me of the easiest way of checking the services running under the svchost.exe process.

MrDuck · 28 Oct 2015

Well I found out how to use Task Manager to split out the services and attach screen shots of the svchost.exe processes running, and (highlighted in blue) the Services running under svchost.exe (Local Service) (PID1120). I hope this helps.

On the Processes screen I note that STService.exe *32 is using nearly 12,000 handles. Is this normal? Very little is actually happening on the machine as I write...

Callender · 28 Oct 2015

Thanks for your last screenshot. It's the same set of services as in your first post. All I can really ask is did you somehow update your graphics card driver again? Maybe windows update installed a driver update. Do you have Windows Updates configured like this?

svchost.exe (Local Service) eating my RAM!-change-settings.jpg

RE: STService.exe

All I can find out is that it seems to be related to Dell DataSafe backup/recovery software. If you don't make use of it or if you use something else for backup then disable it.

See: Safely Disable Stservice.exe Process In Windows 7 - Software Hangout - MSFN Forum

However I believe that you would need to stop these processes:

Toaster.exe
STService.exe

Then uninstall Dell Datasafe. It's up to you if you want to try that as I am not familiar with this software.

MrDuck · 29 Oct 2015

Thanks Callender for the continued support. I am confident I still have the latest graphics driver. I believe (but have yet to completely analyse) that the growth of svchost.exe (LocalService) is some sort of exponential so after the driver update there seemed to be a radical improvement, but after time the rate of memory eating increases and I shall need to reboot my machine today to stop it running out of RAM as svchost.exe is now up to 1.5GB.

I think that all this trouble started after I updated to IE11 a couple of months back as the machine was highly stable before. All seemed to be well at first but after a week or so the browser virtually stopped and was giving error messages. On reflection this must have been due to the machine running of RAM, but I didn't realise that at the time and reverted to IE10. Unfortunately the memory eating defect has remained.

I'm now thinking of applying one or more of the various HotFixes that MS offer but that's really out of desperation, as otherwise I feel a complete rebuild coming on which is not good news.

Callender · 29 Oct 2015

I've just noticed rather interestingly that the process using the most active RAM in your screenshot from Post #13 in this thread shows Dell Datasafe Backup log (under STSservice) is using the most RAM. It doesn't appear to be very high RAM usage but as you say with 12000 open handles for the service it could be a problem.

RE: Internet Explorer issues. Have you tried a full reset of IE yet? I have to confess that I'm not much of an expert on IE as I rarely use it.

Reset IE:

Control Panel> Internet Options> Advanced Reset

svchost.exe (Local Service) eating my RAM!-reset-ie.jpg

After a reset you need to go to Control Panel> Internet Options> Programs> Manage Add-Ons and re-renable any that you still use.

It might also be worth taking a look at the tutorial by Brink here:

How to Uninstall IE11 in Windows 7 to Restore Previous Version of Internet Explorer

Note: Windows Update may attempt to download IE11 again if you have configured it to automatically download updates.

RE: Rebuild. Personally I find it best to create weekly system image backups and then if a hard to fix problem occurs I simply make an image backup of my current windows partition and restore the working backup image. Then copy any changed or missing personal files in certain directories from the backup I made to the restored partiton.

MrDuck · 30 Oct 2015

Hello Callender. In response to your various suggestions:

1. I tried disabling the Dell applications but it made no difference.

2. There is a huge amount of info on the internet about the nsi service leaking memory, and it seems almost certain that this is the service running under svchost.exe (LocalService) that is causing my problem. The exponential nature of the memory leak is also mentioned so it all fits together. Some people have found rewinding to an early version of IE to be solution (e.g. Massive svchost.exe memory leak w/ nsi windows 7 - Tech Support Forum) but I don't think I can get back to an earlier version than IE10 on my build, as IE10 is not shown in the Uninstall list via Control Panel.

3. I used to do image backups with XP but unfortunately the tool I used (a Ghost variant) did not work with W7. What tool do you use, please?

Now I know that I am very much not alone I will keep researching. This ten page thread seems pretty relevant: nsi memory leaks fixed yet? - Microsoft Community so maybe a Hotfix is the best way forward.

Kind regards