svchost.exe high memory usage - wuauserv

Question

I'm running Windows 7, and I've been experiencing high memory usage from one of my svchost.exe processes.

Services under that particular process are BITS, EAPHost, IKEEXT, LanmanServer, MMCSS, ProfSVC, RasMan, Schedule, SENS, SharedAccess, ShellHWDetection, Themes, winmgmt and wuauserv.

I've been able to narrow it down to a specific service by separating each services into its own process and identified wuauserv as the cause.

Stopping the Windows update service(wuauserv) stops the insane memory usage but that's not a solution.

Any help please?

I've have already tried re-naming the SoftwareDistribution folder and re-registering the Windows Update Agent. Nothing has worked so far.

Answer 1

An update to fix the issue has been rolled out:

Please see KB3050265

Answer 2

In my experience, when wuauserv starts eating memory, the best thing to do is to wait until it finishes installing the updates and then reboot.

If you can't or aren't willing to reboot now, you can always reset wuauserv with the following BAT script (right click & run as administrator):

net stop wuauserv
net stop bits
rd /s /q %windir%\softwaredistribution
net start bits
net start wuauserv
wuauclt.exe /detectnow

Hope it helps.

Answer 3

I don't know if you still have this issue but I had something similar in Windows 8. I had data transfer of several hundred MB per day and using NetBalancer identified the issue as the Windows update service (wuaserv) so I disabled it and then ran the MS Fixit option for Windows update. I think there is one for Windows 7 here but do check it is compatible before you run it.

http://windows.microsoft.com/en-gb/windows/troubleshoot-problems-installing-updates#1TC=windows-7

Although its early days I have turned automatic updates back on and so far so good. At least I know what to stop if the problem comes back again. The NetBalancer program was a great help in identifying the problem.

Hopefully you have already solved it, if not this might be worth a try.

Answer 4

I found the following article: https://social.technet.microsoft.com/Forums/windows/en-US/4a782e40-bbd8-40b7-869d-68e3dfd1a5b4/windows-update-scan-high-memory-usage?forum=w7itproperf&prof=required

I think microsoft did something in the mid of 2014 - this post also starts in Nov 2014, yours in Oct 2014...

We have this issue too at a customer with about 60 PCs... we had to disable the Windows Update service for now. Official answer from microsoft is pending, hopefully the give us a patch sometime...

Answer 5

svchost.exe is used as a common system process, some malware often uses a process name of "svchost.exe" to disguise itself. The original system file svchost.exe is located in C:\Windows\System32 folder. Any file named "svchost.exe" located in any other folder can be considered as malware