svchost eating up memory

Solution 1:

SVC Host is made up of many services running on your machine. I recommend you either right click on it and choose "View Services" to see what is actually causing it (after choosing show processes from all users).

You can also use Microsoft / Sysinternals Process Explorer which should show you in more detail what is happening.

(Hovering mouse over the svchost.exe process in Process Explorer)

Solution 2:

The problem is that multiple services share a single process (a very silly design). This sharing means that if one of them uses a lot of memory, you cannot easily identify it. Worse, if one of them crashes, all of them go down. Likewise, if you want to kill the bloated mess, all of the services contained inside it die.

There is something you can do with Task Manager's list of services for that process, besides balk at it with exasperation. You can isolate those into their own svchost.exe processes to continue the investigation. If a svchost.exe uses a lot of memory and contains only one service, then that is the culprit.

I'd start by isolating the likely culprits, like Windows Update, which is known to cause svchost.exe bloat.

There is a recent fix for Windows Update which may help with this problem. KB3050265, among other things, "... addresses an issue in which system performance can be decreased during scans. This issue has the greatest effect on computers that have a small amount of physical memory."

There is a Superuser question dealing with service isolation, if you want to try it: "Isolate hosted service (svchost.exe) in its own process".

Here are screenshots of the problem happening, on a system in which the Windows Update Service has been isolated to its own process, confirming that it's the culprit:

Here is a capture of the Task Manager window on the same system, after the KB3050265 patch is applied. The typical behavior is now that the update service takes cap at around a 300 megabyte footprint (much smaller than before), while tying up a procesor 100%. Not ideal, but the impact on the system responsiveness is greatly mitigated. It finishes after a few minutes and is gone: