I have a 64bit Windows 8.1 system operating under Deep Freeze and most of the time it is very very very stable. However at random intervals one of my processes, one of the many system svchost.exe instances, suddenly starts grabbing massive amounts of Private Bytes according to Process Hacker. Typically the process floats between 20MB to 80MB of memory but when this problem pops up it rises to about 1.5GB in less than 5 minutes and stays there for a while then just as suddenly starts to drop memory until it hits about 200-300MB and stays there a long time. Eventually it goes back to the normal range. Honestly I would not care much except that when that much memory is consumed the system comes to a crawl making many applications non-responsive and sluggish.
Using Process Hacker I can provide the following information:
The process command line is:
C:\Windows\system32\svchost.exe -k netsvcs
and the executable has been verified as Microsoft version 6.3.9600.16384
The services running under the process are:
What I want to know is how can I identify the specific service out of this list? Based on some filenames I have seen after the process starts dropping back down I suspect it may be that Windows is trying to update something but I have all automatic updates turned off since it makes no sense to try and update a frozen system. If Windows is doing something that I am not aware of then it is an off-the-books activity.
NOTE1: I am confident that I can rule out malware since the system was put in DeepFreeze the first day I bought it three years ago. Other than the custom software I installed (like MS Office 2010) before freezing it is pretty close to factory -- which I believe explains it's high stability. I only started experiencing the problem about a year ago and since that time I have rebooted a number of times which resets to the frozen state.
NOTE2: Trying to access certain properties of the process I get told "access denied" even though I am running the admin/sole user account on this machine.