I have a 64bit Windows 8.1 system operating under Deep Freeze and most of the time it is very very very stable. However at random intervals one of my processes, one of the many system svchost.exe instances, suddenly starts grabbing massive amounts of Private Bytes according to Process Hacker. Typically the process floats between 20MB to 80MB of memory but when this problem pops up it rises to about 1.5GB in less than 5 minutes and stays there for a while then just as suddenly starts to drop memory until it hits about 200-300MB and stays there a long time. Eventually it goes back to the normal range. Honestly I would not care much except that when that much memory is consumed the system comes to a crawl making many applications non-responsive and sluggish.

Using Process Hacker I can provide the following information:

The process command line is:

C:\Windows\system32\svchost.exe -k netsvcs

and the executable has been verified as Microsoft version 6.3.9600.16384

The services running under the process are:

enter image description here

What I want to know is how can I identify the specific service out of this list? Based on some filenames I have seen after the process starts dropping back down I suspect it may be that Windows is trying to update something but I have all automatic updates turned off since it makes no sense to try and update a frozen system. If Windows is doing something that I am not aware of then it is an off-the-books activity.

NOTE1: I am confident that I can rule out malware since the system was put in DeepFreeze the first day I bought it three years ago. Other than the custom software I installed (like MS Office 2010) before freezing it is pretty close to factory -- which I believe explains it's high stability. I only started experiencing the problem about a year ago and since that time I have rebooted a number of times which resets to the frozen state.

NOTE2: Trying to access certain properties of the process I get told "access denied" even though I am running the admin/sole user account on this machine.

  • Ok, I see your screenshot now. You can't see the windows update process because it is not currently running and your memory usage is currently normal. You need to check when it is actually acting up. Or, checking for windows updates will replicate the issue. – Appleoddity Jul 25 '17 at 0:46
  • You can use Task Manager in Windows to find the processes running under each svchost.exe instance, and also see what memory they are using. – Moab Jul 25 '17 at 0:47
  • @Appleoddity - I have Windows Updates turned off. It makes no sense to try and update a frozen system so why waste the bandwidth. That said I wonder if there is a "hidden" update process that Microsoft might be running other than the official one that I turned off. – O.M.Y. Jul 25 '17 at 0:54
  • @Moab Process Hacker is an advanced Task Manager replacement. I can see more with it than I can with the default. – O.M.Y. Jul 25 '17 at 0:55
  • Your comment about it not making any sense is just not accurate. If you froze your system 3 years ago you are running a nearly vanilla Windows 8.1 installation. There are a ton of security and stability improvements released since then. You can thaw your system and install the updates then refreeze it. It is a routine thing to thaw, update, and freeze. Updates since 8.1 release: support.microsoft.com/en-us/help/4009470/… – Appleoddity Jul 25 '17 at 1:18

This sounds exactly like Windows Updates running. The high svchost memory usage is typical of Windows 8.1 and older. And the tell tale sign is the intermittent spike then drop every so often, usually shortly after booting or coming out of standby.

I'm not sure if you tried to provide a list of processes in your question, because I don't think it displayed properly. You can view what specific processes are running under the svchost (shared service host) with Process Explorer. I think it gives you memory and CPU usage details more than your screenshot above.

This is symptomatic of these older operating systems but it typically means you don't have enough RAM in your computer. Are you running with 2GB or less? 4GB or more should be absolutely fine. You can disable Windows updates as it sounds like you have done, but I suspect you have not fully disabled them. How did you disable them? The way that it needs to be done is to stop and disable the Windows Update service.

If you used deep freeze on the system and locked it as it was 3 years ago, without allowing for any Windows updates, this is really a bad idea. Microsoft is continually releasing updates that improve the security and stability of the operating system. They've even released a major update to the Windows update components several times, the most recent of them has fixed a lot of the memory usage problems. You should be thawing your system periodically and installing all available Windows updates. Then you wouldn't have issues like this. You might have quite a lot of trouble trying to get it up to date now, so there are some update rollups and windows update agent updates you can install to help get you there quicker. But, it's a bit confusing to find the right ones and it sometimes takes some experience and trial and error to find the proper ones that actually update the proper components. So, I won't be able to link you to any of those. The first thing to do, if you choose to install the missing updates, is just try it and wait patiently.

Also, I know this doesn't pertain to your question, but most people think Windows 8 was a pretty terrible operating system. Windows 10 is far better, and you can upgrade it for free and easily by simply clicking "Update Now" here: https://www.microsoft.com/en-us/software-download/windows10

  • I have 6GB of RAM so I'm not short there. I do however tend to run some memory intensive apps already so when this pops up it overloads the system. I will check if Windows Update has a service running next time this happens. If so I will try and stop it as you suggest. I locked the system because in the past I have had issues with updates screwing my factory hardware drivers. As long as it is frozen there is no security risk since every time I reboot all viruses and such vanish. I do not have any information on my machine that is sensitive so if spyware does get on it is not an issue. – O.M.Y. Jul 25 '17 at 2:02
  • Okay, when it happened this time I waited for the numbers to peak at about 1.5GB and start falling - I wanted to avoid having a lot of hung memory allocations in case the service did not stop cleanly. When the numbers got down to about 300MB I stopped the wuauserv service and the memory consumption immediately jumped down to about 25MB. I then disabled the service to prevent it from starting again. Your diagnosis and solution were spot on. Thank you. – O.M.Y. Jul 26 '17 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.