37

Sometimes, when my computer is frozen and just about unusable, it seems that the cause is some heavy background processing. Sometimes, I can catch who is using all my disk-bandwidth using Resource Monitor (such details are not shown in task manager). I suspect that this svchost.exe instance is really showing the activity of the service for Windows Update, but I am not sure if I can find out for sure.

Here's what I see:

enter image description here

Question is: What does LocalSystemNetworkRestricted mean, and can I associate an entry in Resource Overview that tells me it's svchost.exe with what service that is?

The good part is that the File column in the screenshot above (if expanded) tells you what actual file is being written or read, and this in turn has helped me with my theory that this is windows-update, and MSI-installations of windows-updates (which are probably subprocesses owned by the service) that are showing up as "svchost.exe (LocalSystemNetworkRestricted)", but I'd like to know for sure. If the file in question is the Pagefile, then my system is most likely being swamped by page-file reads/writes (known colloquially as My System is Thrashing, and needs more Physical RAM). But the cause, in the end, seems to be some windows service.

Update Not Windows Update, though, it turns out it's SuperFetch, a colossal Vista misfeature.

2
  • I have also found that on many laptops where the drive is failing, the same slowness in SuperFetch is shown, but it's a SYMPTOM, not the CAUSE.
    – Warren P
    Sep 16 '14 at 20:10
  • A related nightmare of a absurdly poorly written application is Windows Defender, which is far worse, reducing powerful systems to their knees during its "update process" and sucking cycles the rest of the time too. It appears as svchost secsvcs. Though it has the scary important name (abbreviation) of "security services", I'd urge you to remove it. AAR a stopgap improvement is go services.msc and stop the service Windows Defender. (My scope of experience is Windows 7 64) Dec 25 '18 at 16:37
31

This annoying system pig-out is caused by a Windows Vista mis-feature (piece of crap) called SuperFetch. While the service still exists in Win7 it's been fixed up and doesn't seem to slow me down anymore, although your mileage may vary.

http://en.wikipedia.org/wiki/Windows_Vista_I/O_technologies#SuperFetch

After disabling this crap-fest, from the Services window (type Services into the start menu search box, find Superfetch, stop it then disable it from auto-starting), these freezeups go away. On systems with sufficient RAM and disk-throughput, superfetch results in a net increase in system performance. On my laptop enabling SuperFetch results in periodic freezes of the system where it doesn't respond at all to mouse clicks. I thought I was going crazy, but it was part of the stuff that the people who brought you UAC and other great innovations threw into Vista. I think it's been reworked or scrapped in Win7 so it won't do this.

Update Commenter says he sees this in Win7. I have yet to encounter a problem with Win7 on laptops, but then all my laptops have very high performance 7200 RPM drives or hybrid or solid state drives. I would like to hear in comments from people who have this problem with SuperFetch slowing down a DESKTOP machine with a 7200 RPM conventional drive, or SSD. (I could imagine this happening on a dog of a hard drive with a 5400 RPM spindle rotation speed.)

Update2 Part of the problem with Windows is that it only reports parent process svchost.exe, and you need to read the other answer below that points you to the SysInternals Process Explorer too, which helps you to find out what actual thing inside svcchost.exe (like superfetch or windows update or something else) is actually slowing your machine down.

13
  • 2
    Actually there's a contest on vista between crappy mis-features. Windows Defender will also consume 100% CPU and 100% disk-bandwidth sometimes.
    – Warren P
    Aug 1 '12 at 13:23
  • Thank you very much for this! I thought I was going crazy. Windows Vista working fine for years and then about a month ago completely slowed down till almost unusable. Sep 18 '12 at 20:25
  • 2
    I'm curious if you were using a Vista laptop. It seems superfetch is most stupid on laptops, because it seems to be calibrated or designed around 7200RPM high-throughput SATA desktop drives, not the lower performance laptop drives.
    – Warren P
    Sep 20 '12 at 19:30
  • 1
    I had the same problem on my Lenovo T540p with 4GB RAM and 7200rpm drive running Windows 7 x64. When the memory usage goes over 3.5 GB the laptop was really slow and the svchost.exe was consuming large amount of memory (~ 1GB). After upgrading to 8GB RAM this problem disappeared and now the svchost.exe consumes most RAM of all the processes but usually about 250MB. and the total usage is about 5.2 GB. Later I will experimet with stopping SuperFetch.
    – vladiz
    Oct 30 '15 at 12:48
  • 1
    Win7 x64: SuperFetch caused problems for me as well. i7 860@2.80 GHz, 12 GB RAM. After getting LG 34UM67 monitor, started getting svchost.exe (LocalSystemNetworkRestricted) growing up to 2 GB. Disabled and stopped SuperFetch, immediately saw the svchost process in question disappear. Feb 19 '16 at 17:41
11

Use Process Explorer and hover the mouse pointer over the process name (with the same PID) for information on the Windows services running in that process:

Screenshot of Process Explorer showing services in one svchost.exe process

1
  • 4
    +1 for Process Explorer. Always a sensible improvement over the stuff built-in to the OS.
    – Warren P
    Apr 17 '12 at 17:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.