Excessively high memory usage on new Win7Pro machine

[Fardringle]

I just installed several new Dell Optiplex 3020s running Windows 7 Pro at a small office I support, running virtually identical applications on all of the machines, and had no issues except on one computer that has insanely high RAM usage and feels slower than a 2000 era Celeron (these are quad core i5 machines with 8GB RAM). I have narrowed the problem down but am not sure why it is happening.

One instance of SVCHOST has been seen using 2-3GB of RAM within 10 minutes of booting and that keeps increasing to as much as 18-20GB of RAM (all physical ram plus all of the somewhat oversized swap file) if it is allowed to run for an extended period of time. This is not the normal Windows 7 prefetch caching as it has a huge negative effect on the performance of the computer.

The services associated with the instance of SVCHOST in Task Manager are:
AeLookupSvc (Application Experience)
Appinfo (Application Information)
BITS (Background Intelligent Transfer Service)
gpsvc (Group Policy Client)
IKEEXT (IKE and AuthIP IPsec Keying Modules)
iphlpsvc (IP Helper)
LanmanServer (Server)
ProfSvc (User Profile Service)
Schedule (Task Scheduler)
SENS (System Event Notification Service)
ShellHWDetection (Shell Hardware Detection)
Themes (Themes)
Winmgmt (Windows Management Instrumentation)
wuauserv (Windows Update)

Killing that SVCHOST process does release all of the RAM, dropping memory and swap file usage from 99% to around 30%, and the computer starts responding quickly again temporarily, but that kills quite a few apparently important services so stopping the process it isn't a good long term solution.


Process Explorer lists the same services under the same process but I haven't been able to find a way to get it to tell me how much RAM each individual service is using so I don't know how to tell which one is causing the problem except by disabling each service individually and then rebooting the computer again to watch the effects. I hesitate to do this, though, since disabling some of those services might prevent Windows from booting properly.


I would appreciate any ideas how to fix this since it makes the computer virtually unusable.

Thanks.

 

[ninaholic37]

but I haven't been able to find a way to get it to tell me how much RAM each individual service is using so I don't know how to tell which one is causing the problem except by disabling each service individually and then rebooting the computer again to watch the effects. I hesitate to do this, though, since disabling some of those services might prevent Windows from booting properly.

14 restarts to narrow it down sounds like an interesting option. If you try this, it would be interesting to hear which one is the culprit.

http://forums.anandtech.com/showthread.php?t=2347478

 

[postmortemIA]

well there was huge svchost bug for windows xp that got recently fixed, it had to do with machines needing a lot of windows updates... so stupid question first... did you install all updates?

 

[Fardringle]

It's Windows 7 Professional, not XP, but yes, all available updates have been installed..

I'm not looking forward to 14 reboots (plus time between reboots to watch the memory usage) but it seems like that's how I'll be spending the next few hours.

 

[theevilsharpie]

Windows Update or (more likely) WMI are the two services that stand out as likely to cause something like this.

Next time this happens, try stopping those two services in particular and see what happens.

 

[Fardringle]

Well, that was an interesting (and immediate) result. I stopped the Windows Update service in the Services Control Panel and the 'naughty' SVCHOST process immediately dropped from the roughly 3.5GB it was using at the time down to about 70K. And then when Windows automatically restarted the service a few seconds later, the SVCHOST jumped right back up to 1.2GB (and climbing) again. The strange thing is that even with the service set to Disabled and Windows Updates turned off, Windows still keeps restarting it right back up again.

So it's almost certainly Windows Update causing the problem, but that leads to the questions of "Why?" and "How can I fix it?"

 

[Steltek]

Maybe the system has a faulty Windows installation. It might be one of those situations where you are better off just doing a factory restore from the restore partition to see if it fixes the issue, especially if you aren't that far into your installation process.

 

[HOSED]

Steltek has a good idea, I am lazy , I would create a standard image from one of the machines that running good and restore it to the machine in question. Just curious are all of the users setup as standard or Administrator ?

 

[Fardringle]

The users have local admin rights on their machines (not preferable, but their customer management software won't run any other way). If I hadn't already spent many hours setting things up and copying the user's profile from their old computer, reinstalling Windows would be an easy and obvious fix, but I really don't want to do that now since it would mean more hours of doing it all over again. I might have to do it anyway, but I'm hoping to find a way to fix it since the rest of the system seems to be working fine once I got Windows to actually leave the Windows Update service turned off.

It's kind of strange that the system worked perfectly while I was setting it up, and the problem only showed up after the end user started using it.

 

[JackMDS]

Process Explorer lists the same services under the same process but I haven't been able to find a way to get it to tell me how much RAM each individual service is using so

Thanks.

In Process Explore click on the View (top) menu scroll down and choose Choose Select Columns. In the memory tab you select variety of Memory displays.

Also right clicking on a Process Discription line has some choices that can help in Id what is going on.

This Might help too.

http://www.hanselman.com/blog/Figur...t100CPUWithoutComplicatedToolsInWindows7.aspx

 

[Fardringle]

Thanks, Jack, but those memory options all only show the total memory used by the SVCHOST process, not by the separate individual services running inside it since the individual services don't get their own line in the list. They just show up as being part of the process when hovering the mouse over the SVCHOST entry.

Right-clicking on the process description gives the option to set the process affinity and priority, kill/restart/suspend the process, create a dump file, show the properties of the process, and do a search online for information about the process. These can all be useful at times, but unfortunately still don't show how much memory the individual services running inside the SVCHOST process are using.

However, it's a moot point now since I have confirmed that it is definitely the Windows Update service causing the problem. The issue now is figuring out how to fix it. Searching online shows a lot of results for this problem on Windows XP (known issue) and only a few for Windows 7, none of which have any useful suggestions for fixing the problem that I can find.

 

[Chiefcrowe]

Hmm - what happens if you give the user full rights to the CRM software folders, will that work?

The users have local admin rights on their machines (not preferable, but their customer management software won't run any other way). If I hadn't already spent many hours setting things up and copying the user's profile from their old computer, reinstalling Windows would be an easy and obvious fix, but I really don't want to do that now since it would mean more hours of doing it all over again. I might have to do it anyway, but I'm hoping to find a way to fix it since the rest of the system seems to be working fine once I got Windows to actually leave the Windows Update service turned off.

It's kind of strange that the system worked perfectly while I was setting it up, and the problem only showed up after the end user started using it.

 

[Steltek]

Out of curiosity, does the system do the same thing if you create a new user profile on it? I'm wondering if you could have a corrupted user profile.

 

[imagoon]

Use process explorer and drill in to the process. It will tell you exactly which thread is the problem. However update issues after the user took over indicates the user did something or has a virus now.

 

[fusion22]

I was thinking more along the lines of if there were any software the user installed through visiting a website. Check for things like in programs and features for any software that may seem unusual or do not have a company name in the list. Also check for any add-ons in the browser that may need to be removed.

if your not sure what is being run on startup msconfig should let you know. of course, you have to keep a good eye out for things you accidentally don't want to disable.

If the computer ran fine after all initial updates before the user started using it, it kind of tells me some software you did not install has now been installed.

 

[Fardringle]

I did check that, fusion22, but nothing is installed that I didn't put on the machine. Unfortunately, it was (and still is) Windows Update that is causing the problem on this one computer. I still don't know why and haven't had time to troubleshoot it any further yet, so for now automatic Windows Updates are disabled and the computer is running smoothly. The user (or I) just has to remember to manually check for updates once in a while until I can either figure out the cause or I get annoyed enough to waste a day reinstalling Windows and all of the software that she uses.

That's actually a valid question about user profiles, steltek. Since it is Windows Update that is misbehaving, I'd be surprised if that was the issue but it is definitely something worth testing. I'll create a new user profile on the machine the next time I am at their office to see what happens.

I considered the possibility of a virus as well, but did a full scan of the system using a few different security tools and nothing was detected.