How to identify memory hoarding service within svchost.exe process?

Question

I have a 64bit Windows 8.1 system operating under Deep Freeze and most of the time it is very very very stable. However at random intervals one of my processes, one of the many system svchost.exe instances, suddenly starts grabbing massive amounts of Private Bytes according to Process Hacker. Typically the process floats between 20MB to 80MB of memory but when this problem pops up it rises to about 1.5GB in less than 5 minutes and stays there for a while then just as suddenly starts to drop memory until it hits about 200-300MB and stays there a long time. Eventually it goes back to the normal range. Honestly I would not care much except that when that much memory is consumed the system comes to a crawl making many applications non-responsive and sluggish.

Using Process Hacker I can provide the following information:

The process command line is:

C:\Windows\system32\svchost.exe -k netsvcs

and the executable has been verified as Microsoft version 6.3.9600.16384

The services running under the process are:

What I want to know is how can I identify the specific service out of this list? Based on some filenames I have seen after the process starts dropping back down I suspect it may be that Windows is trying to update something but I have all automatic updates turned off since it makes no sense to try and update a frozen system. If Windows is doing something that I am not aware of then it is an off-the-books activity.

NOTE1: I am confident that I can rule out malware since the system was put in DeepFreeze the first day I bought it three years ago. Other than the custom software I installed (like MS Office 2010) before freezing it is pretty close to factory -- which I believe explains it's high stability. I only started experiencing the problem about a year ago and since that time I have rebooted a number of times which resets to the frozen state.

NOTE2: Trying to access certain properties of the process I get told "access denied" even though I am running the admin/sole user account on this machine.

Answer 1

This sounds exactly like Windows Updates running. The high svchost memory usage is typical of Windows 8.1 and older. And the tell tale sign is the intermittent spike then drop every so often, usually shortly after booting or coming out of standby.

I'm not sure if you tried to provide a list of processes in your question, because I don't think it displayed properly. You can view what specific processes are running under the svchost (shared service host) with Process Explorer. I think it gives you memory and CPU usage details more than your screenshot above.

This is symptomatic of these older operating systems but it typically means you don't have enough RAM in your computer. Are you running with 2GB or less? 4GB or more should be absolutely fine. You can disable Windows updates as it sounds like you have done, but I suspect you have not fully disabled them. How did you disable them? The way that it needs to be done is to stop and disable the Windows Update service.

If you used deep freeze on the system and locked it as it was 3 years ago, without allowing for any Windows updates, this is really a bad idea. Microsoft is continually releasing updates that improve the security and stability of the operating system. They've even released a major update to the Windows update components several times, the most recent of them has fixed a lot of the memory usage problems. You should be thawing your system periodically and installing all available Windows updates. Then you wouldn't have issues like this. You might have quite a lot of trouble trying to get it up to date now, so there are some update rollups and windows update agent updates you can install to help get you there quicker. But, it's a bit confusing to find the right ones and it sometimes takes some experience and trial and error to find the proper ones that actually update the proper components. So, I won't be able to link you to any of those. The first thing to do, if you choose to install the missing updates, is just try it and wait patiently.

Also, I know this doesn't pertain to your question, but most people think Windows 8 was a pretty terrible operating system. Windows 10 is far better, and you can upgrade it for free and easily by simply clicking "Update Now" here: https://www.microsoft.com/en-us/software-download/windows10