Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is going on here? I have almost nothing running.

6.5/8

By almost nothing, I mean Firefox, and some background network applications that are entirely passive and would never use this much memory.

Related services: UxSms, TrkWks, SysMain, PcaSvc, Netman, CscService, AudioEndpointBuilder, TabletInputService

The only thing I can think of is that I was running Virtualbox with Ubuntu for a little while but that is limited to 2GB of memory and it's no longer running.


Edit: I am most interested in the question of why/how? Likely a leak somewhere but given the services listed above, do any stand out as being a potential culprit?

share|improve this question
1  
    
See more usefull info windowstechinfo.com/2015/05/… – Aravinda May 4 '15 at 5:21
up vote 23 down vote accepted

svchost.exe is the process that runs all your windows services. One of them has gone mad apaprentely. right click on svchost.exe and select "Go to Service(s)". That will tell you which service it is, and you can use services manager to restart or disable it if you dont need it.

For a better description with nice screenshots check out:


Per your update, you can check out a couple of those services:

  1. CscService: Related to the "offline folders" feature of Windows. Do you use that?
  2. UxSms: Related to Desktop Window Manager. Try disabling Aero, see if the problem occurs.
share|improve this answer
6  
This might be a little too late, but in my case it's always the wuauserv service, also known as Windows Update. It uses more than 700Mb in my poor 1 Gb RAM PC. I always have to stop that service so I can do something. – TIMINeutron Dec 10 '14 at 8:14
    
@Colin, How can we right-click and 'Go to Service(s)' using Sysinternals Process Explorer? There doesn't seem to be that option in right-click menu : i.stack.imgur.com/8M5Hm.png – Pacerier Jun 9 '15 at 7:15

After splitting suspected services to separate processes I was able to identify Network Store Interface Service (nsi) to be the cause of memory leak in my case (Windows 7).

There is ten-page thread about this issue at http://answers.microsoft.com/en-us/windows/forum/windows_7-system/nsi-memory-leaks-fixed-yet/f3c3e9db-36a7-45df-9dbd-de9455378498.

It mentions a couple of hotfixes available for download on demand:

http://support.microsoft.com/kb/2847346/en-us

http://support.microsoft.com/kb/2950358/en-us

There is also a similar fix for Vista and Server 2008:

http://support.microsoft.com/kb/2743187/EN-US

share|improve this answer
    
I had that hotfix installed and it fixed it for a number of months but recently (I suspect after a windows update) it has started happening again. Reapplying the hotfix doesn't seem to have any effect. Anyone else in a similar situation? Any solution? – Sam Hasler Sep 18 '14 at 10:38
1  
Brilliant, thanks very much! In my case, 2847346 seems to have fixed it--back to 4KB usage on that task. That service isolation trick will be handy for other troubleshooting as well. – Mark Berry Jan 31 '15 at 18:45

Another option: Use Process Explorer.
It can be downloaded via Microsoft TechNet.

It displays all running processes, you can easily see which svchost.exe is using CPU or RAM resources, to track down which service is runnning wild.

Tip:
When hovering the mouse cursor over the 'svchost.exe' entries, all services associated with this process are listed in an infotip window.
Alternatively, select the process, click "Properties" and choose the "Services" tab.

share|improve this answer
    
Both of those things are possible with task manager also btw. – Enigma Apr 17 '13 at 14:32
1  
True, but I think Process Explorer is making this a bit easier. You can also view all threads, stack, network connections and security settings etc. of the svchost.exe process in question, as well as detailed performance data and graphs for a single process only. – Awa Apr 18 '13 at 18:06
1  
Can it tell which of the many services running under each svchost process is consuming all the memory? Because if not, then its useless. – Havenard Apr 18 '13 at 18:14
1  
Basically, yes. You can view the CPU usage / cycles per thread and also settings like memory priority. The service that belongs to a given thread is also listed. It's not a debugging or profiling tool, though. – Awa Apr 18 '13 at 18:37

Thanks Colin for your useful hint.

I found that the Windows Time Service W32Time caused the memory leak. (Windows 7/64 Home Premium, IE11, up-to-date Windows Updates).

Other forum's entries indicate that some Internet Explorer update brought the problem. But I did't try to verify this.

Solution: open the Services panel and disable the W32Time service. Drawback: your clock is no longer synchronised with an Internet time service.

share|improve this answer

https://support.microsoft.com/en-us/kb/2889748 new hotfix diagnosed and solved by microsoft.

share|improve this answer
2  
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – DavidPostill Jun 26 '15 at 9:56
    
Although this may answer the question, you should give a more detailed description of the linked content and explain how it relates to the question. This will help ensure that this answer remains useful in the event the linked page is removed or goes offline. For more information, see this Meta Stack Exchange post. – bwDraco Sep 30 '15 at 1:59

This happens after updating to Windows 7 Service Pack 1. Memory leaks can happen when the background service for Windows Update (netsvcs) is enabled. You can find more info here, among other places. See Awa's answer here to verify that Windows Update is at fault.

One inelegant solution to this issue is to turn off Windows Update and install all updates manually. Run services.msc and set Windows Update and Background Intelligent Transfer Service to Disabled. See here for general instructions on services.

However, several updates to fix this issue have been rolled out by Microsoft. When you first run Windows Update in a new installation of Win7 SP1, it will insist on installing Windows Update Agent [WUA] 7.6.7600.320 (KB2887535), before it lets you check for other updates. Let it do so or apply the update manually if installing offline. After doing so, you might not be able to install other updates automatically until this issue is resolved.

Then, manually download and install the following update:

https://support.microsoft.com/en-us/kb/3083324

This updates the Windows Update Agent to version 7.6.7601.18979.

This is the newest update in a series released by Microsoft to address the issue. Each has been replaced by a newer version, and it seems that you only need to install the newest one. However, if this does not fix the issue, you can try installing an older update in the series, or perhaps install them all sequentially. In chronological order, consult the following updates:

https://support.microsoft.com/en-us/kb/2990214
https://support.microsoft.com/en-us/kb/3050265 (June 2015)
https://support.microsoft.com/en-us/kb/3065987 (July 2015)
https://support.microsoft.com/en-us/kb/3075851 (August 2015)
https://support.microsoft.com/en-us/kb/3083324 (September 2015)

Then, according to this answer, install this update:

https://support.microsoft.com/en-us/kb/3102810 (20-Oct-2015)

This updates the WUA to version 7.6.7601.19046. Theoretically, you should be able to just skip to this step and be fine. However, this update claims to not replace earlier updates, which is why it might be advisable to install the aforementioned update(s) first.

Lastly, it might be advisable to disable the two aforementioned services before manually installing these updates, then re-enable them afterwards. I think you should be fine either way, though you might want to restart your machine after each update, just to be sure.

Reports vary, but this should fix your troubles with Windows Update hogging memory and CPU :)

share|improve this answer

Try to turn off your service for :

Superfetch  
Offline files 

Most of the cases for why svchost is using too much RAM is because the Superfetch service is running.

Superfetch is loading most of applications the you're using into RAM to make it "instantly" to load. But some times it can drain your RAM.

Offline files can also consume lot of RAM.

Last word, maybe if you're having the same case, try to open it using Process Explorer : http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Then right-click and Properties and select Services, for find out what kind of service is running and what could possibly goes wild... :)

share|improve this answer
    
Keep in mind that if none of your other programs are using RAM (as in this question), then it's a good idea for SuperFetch to use the remaining RAM. Unused RAM is wasted RAM. – MSalters Jul 31 '14 at 14:39
    
Keep also in mind that SuperFetch doesn't appear to use RAM. The RAM it uses for file cacheing (It's not just applications) is on the standby page list, where it's part of "Available" memory. And it stays on the standby page list, and is still considered "available". It is not part of any svchost process's working set. So if you're looking for reasons why you either have little "available" RAM, or an overly large working set in one of the svchost processes, SuperFetch is not it. – Jamie Hanrahan Jun 26 '15 at 6:04

The why is most likely a memory leak. Memory is set aside for something, but when that something is finished the memory is not getting marked back as being free. What ever is broke is constantly claiming memory and not setting is to be free again. They normally call this garbage collection.

share|improve this answer

Deep scanning by zone Alarm.

Don't stop svchost.exe that may cause some problems in your internet connection or sounds and voices.

share|improve this answer
    
I had to kill it but Windows recovered. It wasn't a virus but seems to be a leak issue related to the network driver. – Enigma Nov 13 '13 at 18:13

protected by Community Aug 17 '15 at 19:19

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.