Svchost.exe -k Netservices High Ram

Got an HP 6200 with an i5 2400 and 8 GB of RAM, and the RAM has sort of runaway all of the sudden on the system. svchost.exe (Netservices) is high, which usually means it's somehow involved, but I can't figure out how. Windows updates have been off for a year on the PC (I think that's another version of svchost anyway). Also I ran an sfc /scannow, but that's not finding anything. I went so far as to turn off all security and disable it fully (followed by numerous boots), after three attempts at a System Restore indicated that the restore could not be performed because a file could not be accessed. The Windows instruction was to turn off/disable all security. Tried all that but nothing.

Haven't booted into safe mode yet, but I wonder if anyone has had a run in with this particular issue. RAM is usually about 45% with Firefox open and with all the system tray programs running. Right now, it's at about 65% in the same situation.

I'm kind of inclined to just let it go and see if the PC rights itself. It's still running great, and there aren't any stutters. sfc /scannow finds nothing to fix, and I'm not at the present time losing functionality.

Oh yeah, one thing I should mention. About 2 days ago, I changed the min/max of virtual memory from 8GB/12GB to 2GB/4GB. This is a 6 gig/sec drive, but I was thinking it wouldn't hurt to see if the PC would perform a little bit better relying more on RAM and less on the drive, even though it's a good WD disk. I wonder if this change sparked the higher RAM usage. I was inspired to try this by the performance of an old IDE pentium dual core PC that I have that runs 2 GB of RAM. It is set min/max for virtual at 1 GB/2GB. I can't believe how great that system performs, so that inspired me to see if I could make things a little snappier on this one...

Thanks

 

Try disabling the Windows Update Service and rebooting?

 

How Windows balances physical RAM usage versus virtual RAM usage is anyone's guess. Theoretically, if you significantly reduce the virtual RAM then physical RAM usage should increase. But 65% of 8 GB (± 5 GB) is too high. Change back the virtual RAM and look if the situation improves.

 

It's mostly the Windows update that is the cause of the 25% increase.

I get the same thing in windows 7.

Go into services and set Windows update to Manuel setting.And Stop it if you don't want to update just yet.

When it's set to Manuel settings you can update it your self not Windows doing it Automatically.

Don't disable the settings.That will cause problems later on when you do want to update.

 

You guys are right about Windows update, but this is different. BTW, it is Windows 7.

The reason I am so confident this is different is that Windows updates has been off on the PC for over a year. I'm actually on another PC, right now, but the affected system is stable at 29% RAM after a reboot. The problem is that it will go berserk, all the way up to 70+% and then everything starts shutting down, if I try to use a browser.

I feel like this must be one of those quirks of netservices, like a process is spamming to connect or something, and Windows is just responding to that in this weird way. I haven't changed the software recently to speak of, although I did install Windows Live Movie Maker and Picture Viewer a few days ago. That was the restore point I tried. I went ahead and removed those, using Comodo Programs Manager, and it removed 800+ registry keys associated with WL.

BTW, when I say the system shuts down, I mean everything. The net connection to the PC goes out, when I try to open anything, I get the message "Insufficient resources to complete the requested service." One other thing, I am getting some unusual Private Firewall pop ups about svchost.exe wanting to mess around in the registry. I have the key locations, and it looks to me like these are associated with the internet. Something wanted to mess with group policy too, but in the same registry area. The others were keys in folders called Linkage, Shared Access\Epoch, and Tcpip\Parameters\blah blah, all under HKEY_LOCAL_MACHINE. Not sure if Windows is trying to repair things somehow or if its something else, so I blocked all the activity.

Just had a weird event occur on this PC I am using too. I haven't downloaded a single update on the machine, yet the PC froze a little while ago, and I had to restart (updates is obviously off on this PC too). Strange thing is, Windows said it was configuring updates during the beginning of the restart, but I checked the history list after the reboot, and there is nothing there...no Defender or anything else. I am getting prompts about Media Center wanting to update or something (connect to the internet), which I allowed. I tinkered for about 20 minutes with it a couple of weeks ago . Guess I should have left it alone. I wonder if the update was a Media Center update. I guess they could happen separately, from WUs but I don't know.

I don't see how, but I wonder if PrivateFirewall is behind the problems on the high RAM PC. I guess it could be blocking something that is causing Windows to misbehave. I am going to uninstall it with Comodo Programs Manager, and see what happens then. I have my doubts, but maybe. Going to try system restore again, now that system is quieter (no browser sessions during current sesssion).

Thanks for the help. I will post more once I try the above. Also, I forgot. Everything seems perfect in Safe Mode and SM with networking, but I was only using the PC for like 5 minutes. Maybe I will have to run for a couple of hours at some point to see...

 

If windows update has been shut off double check to see if remote connection is off.Unless you use this option.

I would recommend on running virus and malware scans.

This sounds ominous.

The only problem i seen with windows 7 was the same thing but i only had an issue with the cpu running at 25%.So some thing was installing or downloading i guess but i blocked it by stopping the service.And setting it to the manual.

And probably another idea might be is to empty your temp folder.%Temp%

 

wile e...

I have MBAM Pro, and I ran a scan, but it didn't turn up anything. Temp folder gets cleaned out every AM, so there's not much there other than a bunch of folders with .manifest files inside. I use Windows cleanmgr to automatically wipe the folder, but I don't know why it leaves those folders in there.

Getting rid of Private Firewall helped slow down the pace of the "creep". Private Firewall is something I'm going to want back on the system, however. I booted about 4 hours ago, and now with the browser open RAM is at 49%. If it gets above 60%, I will know that there is something really weird going on. It's creeping up now...up to 52% with me using the PC.

I ran a HijackThis scan, and there are a number of things on there that I don't recall seeing before. Problem is I don't know exactly how to read HijackThis, and the ones in question are listed as unidentified. I think I'm going to go over to malware, and see if they can find out what the cause of this might be.

Thanks for the help you guys. I'll post back what happens...

 

Found this which is dealing with the version of svchost that seeems to be giving me problems:

http://superuser.com/questions/583737/why-how-is-svchost-exe-using-6-5gb-of-memory

There is a hotfix mentioned down about half way in a post that mentions Network Store Interface Service. This sounds 100% plausible to me, because I think it's associated with Media Center somehow. After messing with MC, I have been getting numerous Private Firewall alerts about it, including the Network Store Interface Service.

Gonna try the hotfix...

 

From TaskMan > Processes, right-click on the offending SVCHost > Go to Service(s) will open the Services tab with all the Services running under that SVCHost highlighted. Checking those PID(s) against Resource Manager > Networki tab and Management > Services should enable you to pinpoint the offender.

 

Thanks Satrow...

I tried them all. This svchost is connected to a number of services (but not updates), and only Superfetch really dug into the problem. One of the services called AudioEndpointBuilder wouldn't shut off saying it is needed by another running service. Superfetch did lower the RAM usage on svchost alot, but the overall RAM usage is still way over normal. All it did was go from 59% to 56%. This is with the browser closed. I almost forgot to mention that this is without a-v or firewall even on the PC. I uninstalled them to see if that cured the problem. It did slow the creep, but that's about it.

The biggest problem I am having is that seeing what works to get rid of the problem is not a simple matter like with processor usage problems. I booted last night, and the PC started at 17%. I went to bed and left the PC on and then when I woke up this AM it was at 59%. It's just creeping up almost like it's on a straight line with time. it's really strange how this is happening.

I hate being stumped by these Issues so maybe I will look into startup repair. I do have a Windows 7 installation disk...

UPDATE: OK, at 59%, everything on the PC just shut down with the out of memory error (strange since HWiNFO shows almost 2 GB still free). I still have the mouse, but nothing will open, not folders, programs, or files. Start menu and Taskbar work, but the internet connection has been zapped. Shut down won't even work. If it's not running already, it won't run. This shuts down video in Firefox too. This all happened at once, and it's about the third time since yesterday. I know if I reboot I will be able to get straight back to the desktop, and everything will be good for a few hours. Maybe this is my time to head to malware.

A couple of things about this:
1. I was thinking of running an in place repair. There is a great video at YouTube about how to start the repair in Windows, but should I run Tweaking.com first? If so, which options should I use?
2. I have EMET set up on the PC for various mitigations for Windows and otherwise processes and programs. Also would like to avoid having to reinstall programs, etc. Have an old image, but I would rather save this installation if possible. Ran out of space on the backup drive, because I am using it for backups of other systems, and it's only a 160 GB drive. I was going to move some of that to another PC, but never got around to it unfortunately.

Eldon, thanks. Reset the virtual memory level back to where it was to see if that will help. Not a quick way to see unfortunately.

Oh yes. Hotfix seems to have had no effect on the system for me...

 

You might want to use RAMMap and watch the program listed in the right sidebar there, used carefully along with some other Sysinternals tools, you should be able to pinpoint the culprit.

Reducing the VM/pagefile size will allow the runaway to hit the memory error sooner, not necessarily something you want when you're troubleshooting (but RAMMap can be used to empty sections of unused memory, allowing you to work longer).

 

Thanks Satrow. Took a look at RAMMap, and I ran a Farbar tool called Farbar Service Scanner. The problem is that the issue seems to be affecting all processes all at once, and I can't focus on a single culprit. It does seem to have subsided for now. I booted about two hours ago, and the memory usage is at 34% with the browser open. Mind you, this is without MBAM Pro, 360 Total Security, and Private Firewall running. 360 and PF I removed completely, while MBAM is just off.

Qihoo added an ad interface to 360 TS I noticed yesterday on a PF pop up. Maybe that's the problem or maybe the system didn't like my choice for the virtual memory setting. I have it set on Eldon's advice to the recommended which is actually 8 GB/12 GB min/max. I doubt it's resolved, but I'll let you guys know how it goes. I like the in place repair option, and I might run it if the problem starts back heavy. Going to have to reinstall some security at some point...

 

Not necessary for Tweaking.com - Windows Repair.

Here's the instructions for repairing Windows 7.
http://www.pcworld.com/article/243190/how_to_repair_a_corrupt_windows_7_installation.html
Your settings, programs and files will be intact - that's why it will take longer than a re-install.

 

I'd fully uninstall all 3rd party security software during troubleshooting, use MSE + the Windows firewall and reinstall a freshly downloaded version of MBAM. Don't forget to use the maker's uninstall routine/tools to ensure no dregs remain.

 

Running the repair at the present time. I don't think it's going to solve this problem, though, because I don't think the problem is Windows corruption. I think more likely some program is causing a Windows service to methodically and slowly spam requests for RAM across the board. I started looking for a Windows service that is more or less constantly using a little bit of processor, and I noticed lsass.exe using a little bit. It's tied to SamSs (Security Accounts Manager), but I don't want to turn that off. Not sure if that has to do with logins and so on. It could be that something has gotten into Superfetch, idk.

If all else fails, I will see if I can get the old image I have to work or reinstall if that doesn't work. I gotta say, it's really nice to have a PC with its own monitor sitting right next to the main PC in this situation. Using Mouse Without Borders, I can copy files over from one PC to the other and watch videos and scour the net on the 2nd machine.

Looks like the repair might take a while...

 

While you're waiting...
Make a list of all your programs and post it. We can help rule out those that are not suspect.

 

OK Eldon. I'll post them, but the thing is that I run alot of core management tweakers like Process Lasso and Kiwi Application Monitor. I've run them for years with no problems to speak of, so I don't think they're the problem. The problem has something to do with or is associated (I think) with Windows Media Center or with Windows Live Movie Maker. WL is gone.

Maybe the repair will revert some settings for WMC and fix the problem, who knows? Here's the pic, but I don't think it will give up answers easily. Most of them I know what's in them, and only some of them run on boot...

 

The SVCHost is netsvcs or NetworkService?

 

Dreading running MemTest, but I am beginning to wonder if maybe there's some corrruption of a stick causing Windows to flake out somehow...

 

Actually Satrow here's a pic on another PC that shows basically what it's controlling on the other PC. I think there might be a couple of differences. As you can see it's Local System Network Restricted...

 

If there was anything wrong with your memory sticks, I suspect you'd have been getting multiple BSODs every day with the RAM/VM usage you're getting.

Are you sure that's the same SVCHost?

 

Yes, I'm sure satrow. However, it's just been sort of leading the way, using around 150-170k memory. Everything else is getting bumped up too, as in all at once. I think this could be a service that's not using alot of resources, but is just methodically pecking Windows to death with RAM request spammage. Not sure what could cause this, but, again, I kind of suspect that Windows Live with its 800+ registry changes may have caused some corruption.

See pic below for the svchost as it shows for this PC (just finished the repair about 10 minutes ago).

The repair completed, and everything is fine so far. PC is running sharp and all, but the test will be to see if the RAM starts to creep up again. Memory is sitting at 25% with the browser open and about 20 tabs. I'll leave the PC running tonight and see what happens and let you guys know...

 

Well, WL can certainly cause issues, even months after it's been uninstalled - use Process Explorer to check loaded DLLs in Explorer and other user processes for a WL .dll.

 

Thanks for the information. Windows Live seems like another example of a good idea from MS that somehow gets away from them in development (800+ keys for a movie editor?). I'd like to have movie maker, but I wonder if it's possible to run the old XP version on Windows 7. I think there are probably codecs headaches in that.

Well, watched some video, including live video feeds from Twitch , and the RAM seems to be holding at 27% even with the browser open. Too soon to say problem solved I guess. I'll give it through the night before I start in with security software. I kept the config for PF, and 360 is easy enough to set up...

 

AltBo, you can run Windows Movie Maker 6.0 in Windows 7.
http://movies.blainesville.com/p/wmm-60-on-windows-7.html

You'll need a codec pack to use non-Windows formats.

FWIW I have used it but my PC's hardware is to basic for video rendering.

 

Hey Eldon. That's all the good news in one post. Does this mean it will work with advanced codecs and flash and all that if I am already running Shark codecs, or do I need a codecs pack from MS? I'll look into it when I get a chance. I like to kind of play it cool and stalk my downloads ...

BTW, I just thought I would mention this while I'm keeping an eye on things. I installed the Windows 10 Transformation Pack for Windows 7 on this dual core with 2 GB RAM. I don't recommend this install unless you really know how to McGyver your way through a very complicated installation (and how to do the post install dissection), but now that I have it up and running I gotta say that this is the coolest TP I've seen for Windows. Works on XP too. I also replaced on my own (TP didn't do this) the login/welcome screen, but this TP changes all the folders to the W10 style and the icons and even adds a Cortana style bar to the task bar. It's really sharp. It comes bundled with programs like Start Menu Reviver and Aura, but I disabled them, and the Start Menu for Windows 7 is great this way. Literally every menu and message box is changed by the program. Every single menu/window is Windows 10 design. Here's some pics...

 

It should. I used K-Lite Mega Codec Pack with WMM 2.1 (Windows XP), but that was about 10 years ago.

 

RAM is still holding at 30%. Must have been some registry corruption in prefetch or superfetch or something that could adjust memory usage system wide..

I am very impressed with the in place repair. All I did was change the wallpaper back to what it was after reaching the desktop. Every icon was exactly where it was before the repair, and all settings were just as they were before running the operation. After using it a few times since Windows XP, I would say it's a very good option for repair if all else fails...

Thanks for the help and input. When it all falls apart, you guys are the best around...

 

I was reading through the thread and stopped here at satrow's post as it is absolutely correct. The svchost.exe processes are assigned services to run, from the Windows Firewall, Windows Update, to the Security Center and Event Logs. I currently have about 13 different "svchost" processes under my task manager right now, and the nice thing I've found out about Windows 10 is that I can expand the list to see what services are running under that particular svchost process.

I did, however, read your last post about the superfetch which I wouldn't at all doubt was the issue. I keep that service disabled as I have read from more than one source that it can be a serious resource hog. I'm running on 8GB of RAM and only using about 24% at the moment with 4 tabs open in Chrome. If everything is running smoothly now even with the superfetch running, maybe you're right about the file or registry corruption. I dunno, but glad to hear things are back to normal for ya.

 

It's the best solution to get your system back without losing anything.
I had to re-install the Lexmark & Nero software which was understandable. Both program install files in the System32 folder which were removed during the repair.

 

Noticed this AM a couple of folders left behind by the in place repair of about 2 GB total. Nice that disk cleanup sees them to get rid of them. The folders were called $WINDOWS.~Q and $INPLACE.~TR. Disk cleanup calls them “Files discarded by Windows upgrade”. There was also an option to remove upgrade logs, so I got rid of those. RAM is still holding, so I guess the repair can be useful for some types of memory issues.

By the way, for anyone who hasn't used this technique, it is technically an upgrade repair, but it works as a repair. One really super cool element of this repair is that it got rid of all Windows updates and left Windows SP 1. It left SP1 because I have/used a W7 SP1 installation disk. The best part is that, while removing the Windows updates, it left all of the MS Office 2007 updates in place. MS apparently had some solid thinking in the development of the repair features of Windows 7 when considering all of the automated fixes there are and disk options. All in all I am beginning to become a fan of the update as necessary philosophy for Windows, so I am actually very happy to have the 90+ updates that were on the machine removed. Anyone looking for an easy way to get rid of them, this repair will do the job.

Here are Eldon's link on how to do this and a link to the video I referenced on how to use the Upgrade option of a Windows 7 installation disk to repair Windows:

http://www.pcworld.com/article/243190/how_to_repair_a_corrupt_windows_7_installation.html

 

I'm guesstimating... If the problem was memory-related, it was in the page file which is not cleared when Windows is shut down.

 

You may be right about that Eldon. I just poked around in the Windows\Prefetch folder, and all of the files and folders in there are new. I think prefetch/superfetch manages paging and deeper memory related issues to do with use of the processor cache and other caches and also RAM memory. Something could have gotten into the paging system I suppose and then caused something like Prefetch to go crazy with requests for memory for all running apps and services...

Think I'll do a little test to see if I can lower the size of virtual memory back down to 2GB/4GB without the problem reappearing. I'd like to run with that for a few days. I'll post what happens...

 

You might want to check through the Windows Repair logs before placing any blame.

 

Um well that's a very good idea Satrow, but I used cleanmgr to remove the logs this AM. I would like to see them now that you mention it, for sure.

RAM is holding very strong even after changing virtual memory from 8/12 GB to 2/4 GB. PC is running more the way I like it to run with more desktop level/app level responsiveness.

I did have to reset several settings associated with Customer Experience Improvement. Shut down some tasks and some policies.

Thanks for the idea. Next time I will remember to save them...