svchost.exe (netsvcs) draining all my memory

[Nedly]

Hey - it seems that utilities only report memory usage for svchost and not the services running under it. If you are sure that there are no critical services running try stopping one rather than setting it to disabled. Give me a minute and I'll try stopping and restarting NSI service and see what happens.

System won't let you stop the nsi service, tried that

You should be able to stop it for a small moment. If you are logging with a good auditor you will catch the glimpse like a rector scale. Persistent services will stick, but momentarily the nsi service does stop, and all is recoverable. I was reconnected in like 2 mins. I am not having luck getting the same issue so my tests are not bringing the best of results. Right now I a gathering update information and researching...

 

[ripsw]

memory usage right now is very small for the svchost process at this time, so doing anything like stopping nsi service probably won't yield anything. I will need to let system run over night and then try to force nsi to stop and see what happens.

 

[Nedly]

Is your problem intermittent? Most people have their ram filled. You could try this too, open CMD type:

tasklist /svc /fi imagename eq svchost.exe

 

[Nedly]

This is where I am at....

 

[ripsw]

Not intermittent just takes the memory away at a very slow rate most of the time. Tomorrow morning when I wake up memry useage will be around 50 - 75% is my guess. Right now it is setting at 15%.

 

[Nedly]

Ok, that opens new doors for my curiosity. A couple things we could check out-- Control Panal | Admin tools | event viewer - view system logs etc, try to sort through some of the errors. In this console, you should be able to set up the auditing settings, try to make it audit your services, especially the ones in suspicion. This way you could have some log files to sort through in the morning.

 

[Callender]

Okay so I stopped NSI and lost all network connectivity and got a network detection prompt to join a homw. work or wifi network. A reboot was required. I can't see NSI being the problem.

So if you get the PID and look at the other services this is what I get for svchost that's running NSI.



I can stop font cache and restart. netrofm and nsi both cause issues if stopped. Not sure about the others.

Which services do you see - can you list them?

 

[Callender]

Okay so there's no sudden surge in memory use. I didn't understand that this was the case. You can look at this post for a possible workaround.

http://www.sevenforums.com/performa...have-memory-leak-post3105914.html#post3105914

As for what's leaking I'm not sure how to track it down. Go with Nedly's advice for now but aslo list those services if possible.

 

[ripsw]

Nedly event log is clean, have cleaned up most of my other issue trobleshooting this issue.

Callender - services are eventsystem, fdphost, fontcache, netprofm, nsi, win32time, wdservicehost, and winhttpautoproxy

 

[Callender]

Nedly event log is clean, have cleaned up most of my other issue trobleshooting this issue.

Callender - services are eventsystem, fdphost, fontcache, netprofm, nsi, win32time, wdservicehost, and winhttpautoproxy

Okay well it must be something to do with one of those. I doubt if it is anything to do with the ones I crossed out.

Now I hava a question. Something must have started winhttpautoproxy.

I'm not really sure what it does but on my machine startup type is manual. I'm just checking event log to see if it's ever actually started.

 

[Nedly]

The only way I can think of to try and sort this out, as network techs would do, we would visit logs of the updates that went through to find relative updates, and then narrow down which one is in conflict, then we can roll it back or present it to Microsoft in a bug report. Without log files, and without rewinding updates, I really am not sure how to debug the issue either. There are not many apps that can monitor the same stuff in realtime very well accept for those that audit and log. We need log files like bread needs butter.

You could try something simple like RamRush. There was also a WinTweak application I used to use to force Windows to unload the cached data of closed services and apps. There are apps like Process lasso that will let you put some restrictions on processes.

 

[Nedly]

I think a proxy service would focus more on network bandwidth conflicts versus memory though..

This entire situation reminds me of dependency issues in Linux. Linux software is based on the concept of taking a bunch of mini scripts and setting them up so we can feed commands to one and have its output go to another. So some applications need specific components, and when specific components get updated when others don't, you have dependency issues; because some component will 'depend' on a certain version of another component.

I believe this is what is happening here. I think some services got updated and others are in conflict. The SVCHost has not had serious mods since 2012, so it is a different service that is now causing conflict with the SVCHost, and the bug has not been patched yet.

I am almost positive it has to do with the new Windows shifts, including 10. From my research, this is following the collapse of XP support.

 

[Callender]

Okay it does run but not permanently.

 

[Callender]

@ Nedly. I already use Process Lasso. I also don't have a problem with windows updates but I did experience high RAM usage caused by windows update service (now fixed)

 

[Callender]

@ Nedly. I think those Windows 10 upgrade updates had something to do with it. However I've seen other users resorting to a freah install of Windows 7 to fix the problem and one of those reported that the issue returned when SP1 was installed.

 

[Nedly]

That could only be the case if the version was a new build with the recent updates built in. Also, if that were the case, then it is most certainly an issue based on hardware, probably either the CPU or chipset. If that were the case then there is not much that can be done without patches, but I doubt Microsoft would put out an install that had such big component bugs. The computers I fixed were unfunctional with RAM at 100%, and the issues were recent as the computer owners had the models for over a year with no restores.

I already have no doubt that it is hardware based because even when I match up the software the bug does not exist on all machines. It is a specific build of SP1 with specific updates. I tested on RTM as well and most of the updates are not even the same.

 

[Nedly]

I had an AMD phenom quad 2.4ghz 9500 that never worked with any version of Windows. It finally worked ok with W10, but for years I had to use Linux on it because all the systems were too buggy. That processor actually has a lot of conflicting reviews online, but with Linux it was like a train trucking data.

I got the 1k pc for cheap cheap cause the Vista system on it was garbage, filled RAM and drive read/write at 100% due to update bugs, old files, etc. Some PC's are just tough, as we know, because they have to update bad processors all the time..

I will admit Windows 10 is nice, and is far more functional than any of the previous systems. If you have not tried it you might want to pick up the preview CD and try it, it is free; it comes out later this year. They are taking after Linux, and even working in the Linux languages into Visual Studio.

 

[ripsw]

Nedly, I don't think it has anything to do with SP1 as I have a very old CD with win 7 pro SP1 that I have used on both the problem machine and my laptop that does not have the problem. I do believe you may be on to something about it being a hardware specific issue as I know my Intel based laptop that I did a system rebuild with the cd with the old copy of win 7 pro does not have the problem but my AMD based system that I did a rebuild with the same CD does. Just another point of confusion I think.
Doing nothing on my problem computer the memory for the svchost process is now at 30 KK memory, started at 9KK.

 

[Callender]

Okay I think that this thread and other similar threads might take some time to resolve. Hopefully someone will find a solution.

Take a look at the following post about SP1:

http://www.sevenforums.com/general-...vailable-random-access-memory-after-boot.html

Also check these two posts:

http://www.sevenforums.com/general-...g-up-all-memory-freshly-formatted-system.html

http://www.sevenforums.com/performa...ry-usage-startup-post3098723.html#post3098723

Re: Windows 10. I've tried it and quite like it but will not be wanting to use it for at least six months to a year after it's been released. That should be enough time to iron out any serious bugs!

Will check this thread tomorrow.

 

[Nedly]

Nedly, I don't think it has anything to do with SP1 as I have a very old CD with win 7 pro SP1 that I have used on both the problem machine and my laptop that does not have the problem. I do believe you may be on to something about it being a hardware specific issue as I know my Intel based laptop that I did a system rebuild with the cd with the old copy of win 7 pro does not have the problem but my AMD based system that I did a rebuild with the same CD does. Just another point of confusion I think.
Doing nothing on my problem computer the memory for the svchost process is now at 30 KK memory, started at 9KK.

Well you said it! It is what it is, tests don't lie. If the same cd has separate such as yours on different machines, then it is hard to debunk the hardware theory. But it still stumps me as to the recent increase in the issue, including the machines I checked out. Though, I am pretty certain they were all AMD as well, so there is a chance that there are two levels of conflict, one with the usual bag cpu's, and another with some recent updates on specific AMD systems...

I would be curious to see a different system run on it. Sadly Windows does not offer much for "Live Systems", so installs are always necessary.

If it is an absolute conflict of your hardware type, the best of your solutions will most likely be to choose a different operating system given that all other paths from chipset drivers to BIOS upgrades have been performed.