svchost eating up memory

Question

I'm running Windows 7. It seems that svchost is eating up a lot of memory.

The user name for the particular svchost instance is "Network Service". The description is "Host Process for Windows Services".

Sometimes it eats up 50% of the CPU usage. Other times, it's just under 5%. I can't figure out when it's 50% and when it's not. But it fluctuates often -- even when I've just booted up and no programs were started.

How do I diagnose this?

Solution 1

SVC Host is made up of many services running on your machine. I recommend you either right click on it and choose "View Services" to see what is actually causing it (after choosing show processes from all users).

You can also use Microsoft / Sysinternals Process Explorer which should show you in more detail what is happening.

(Hovering mouse over the svchost.exe process in Process Explorer)

Solution 2

The problem is that multiple services share a single process (a very silly design). This sharing means that if one of them uses a lot of memory, you cannot easily identify it. Worse, if one of them crashes, all of them go down. Likewise, if you want to kill the bloated mess, all of the services contained inside it die.

There is something you can do with Task Manager's list of services for that process, besides balk at it with exasperation. You can isolate those into their own svchost.exe processes to continue the investigation. If a svchost.exe uses a lot of memory and contains only one service, then that is the culprit.

I'd start by isolating the likely culprits, like Windows Update, which is known to cause svchost.exe bloat.

There is a recent fix for Windows Update which may help with this problem. KB3050265, among other things, "... addresses an issue in which system performance can be decreased during scans. This issue has the greatest effect on computers that have a small amount of physical memory."

There is a Superuser question dealing with service isolation, if you want to try it: "Isolate hosted service (svchost.exe) in its own process".

Here are screenshots of the problem happening, on a system in which the Windows Update Service has been isolated to its own process, confirming that it's the culprit:

Here is a capture of the Task Manager window on the same system, after the KB3050265 patch is applied. The typical behavior is now that the update service takes cap at around a 300 megabyte footprint (much smaller than before), while tying up a procesor 100%. Not ideal, but the impact on the system responsiveness is greatly mitigated. It finishes after a few minutes and is gone:

Comments

[Admin]

Correction: "Host Process..." not "Hose"

[GraphicalDot]

How did you get to the Sysinternals Process Explorer?

[William Hilsum]

Updated my post with link - technet.microsoft.com/en-gb/sysinternals/bb896653.aspx Sorry, I forgot it! it is a free download from Microsoft.

[Matthew_Sp]

Just an addendum, I recently had 2 computers both with SVCHost.exe running intermittently and using up half to two thirds of the RAM available. I did check what services that particular process was handling, and they all seemed legit, windows update, wlansvc, etc. I ran a roguekiller scan because I was suspicious still, and in both instances RogueKiller stopped the process and dug out a malicious file. So, virus scan if suspicious maybe?

[Kaz]

I sometimes have this problem. The "go to services" tool in the Task Manager is completely useless. Sure, it tells you which services are sharing that process. But it doesn't tell you which one is gobbling up the memory! Is there some way to isolate those services to that they use their own instance of the service host? Then when the problem happens again, the offending service will be the only thing in its bloated container.

[Kaz]

Aha, question for this: superuser.com/questions/860117/…