Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Windows 7 SP1 on a MacBook Pro via Boot Camp (i.e. it boots natively).

Recently services.exe started exhibiting behavior whereby every 15 minutes or so it will ramp up over the course of 1-2 minutes to use all available memory on the system (in my case all 8GB of memory). It will stay there for a couple of minutes and then ramp down to normal again.

The process itself goes from using ~40MB of memory to ~5GB+ memory and then back to ~40MB..

I've gotten a dump of the process while it was ramping up by using procdump and the 3GB file contained repeating data--it looked like pointers to function calls or return addresses when I looked at it with windbg.

I also took a look with procmon but the data wasn't very enlightening--there wasn't much to look at and what was there looked normal.

What I'm looking for are pointers on how to better look at memory usage by an application so that I can attempt to figure out what is causing this behavior.

share|improve this question

migrated from Nov 15 '11 at 19:42

This question came from our site for system and network administrators.

Ok. If this happens approximately every 15 minutes you can wait to it happen and act fast. Is not necessary to dump the process.

Services.exe is the proccess who launche the services. The services dont run by themself, they are hosted by the processes svchost.exe.

So to know why is it happening, why your machine is cosumming that RAM you need to know which service is causing that.

For accomplish that you can use the Microsoft Sysinternals tool called Process Explorer. Whit this tool you can order the process by memory and more interesting if you clic on a svchost.exe process you will be able to see which services is it running. In Process Explorer you can see the process by tree of parents and child, so you can see which child process of which svchost is causing the issue.

With Procesx Explorer you can also see what threads have been loaded within the process (Yoy have to load the Symbols in order you can see their real names, just go to Options menu, Configure symbols), if you see any strange Thread you will be able to see its threads and see which thread is probably causing the hang.

And to finished, if this happen to quickly for you with Process Explorer you can do a right clic on a process and select suspend. This will pause the execution until you manually resume it, and you will have time to analyze the things.

share|improve this answer

I recently experienced the same problem but I couldn't separate out any service causing this behavior. Also a malfunctioning service would cause the memory usage on svchost.exe, not in services.exe. I finally found that accessing a huge number of files in an EFS encrypted folder triggered the high memory usage (e.g. doing a large checkout on a >10GB GIT repository with small files in an EFS encrypted folder). Decrypting the folder seems to have solved the problem for me. I think I need to switch to Bitlocker or something similar...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.