Windows 10: netsvcs memory leak, need assistance identifying and fixing

My Windows 10 Pro laptop has a serious memory leak going on. If I leave it on overnight, I will often come back in the morning and memory usage will top 90%.When I check my processes, I see Service Host: Local System is where this is happening. When I drill into the services, I see that netsvcs services are causing it. The services running are:

• AppInfo
• BDESVC
• BITS
• Browser
• CertPropSvc
• DoSvc
• gpsvc
• IKEEXT
• iphlpsvc
• LanmanServer
• lfsvc
• ProfSvc
• Schedule
• SENS
• SessionEnv
• ShellHWDetection
• Themes
• UserManager
• Winmgmt

Things I Have Tried

• Stopping some of these indivually with mixed (temporary) results. One time stopping lfsvc (geolaction service) and iphlpsvc (ip helper) dropped the memory usage a bit but it eventually climbed back up. People suggest stopping BITS, but this didn't help either.
• I have tried running the Windows 10 Update Troubleshooter. It claims to have found and fixed issues every single time I run it, but in the long run, it's no help.
• sfc /scannow and DISM. I ran these and they found some issues, which I fixed with a Windows 10 Pro ISO to repair. Still I have a memory leak.
• Registry Updates. Updated TimeBroker and Superfetch per this article
• Full Anti-Malware Scans. No issues found with Norton Security Suite or Spybot
• Updated Killer Networking Drivers. No luck

Any assistance on running this down is much appreciated.

:)

 

My CPU usage reaches 98% when I don't move my cursor for few minutes

Looks like it might be the svchost process.

This is not uncommon.

Below is a link on steps to fix this issue.

Let me know how you make out.

https://www.wintips.org/how-to-fix-svchost-exe-...

 

Memory leak issue

The term "memory leak" means that an application fails to return all its RAM to the operating system when it exits. The leftover RAM is unusable to the operating system.

Step one is to identify the application that is leaking memory. Step two is to contact the application's developers and provide as much detailed data on the memory leak as you can. For example: which processes are still in RAM after the application exits
and how much RAM they occupy. Application developers never want their applications to leak memory and they will be grateful for the details you provide, particularly if they can replicate the leak on their own computers.

 

Hi MacDonals,
I too have experienced this curious annoyance (I have a Win 10 Pro (x64) Desktop PC. Sometimes it happens a few times in one day sometimes not for days and recently until today I had not had a leak for 3-4 weeks. Unfortunately I am not skilled enough to track down the issue,. With my setup I did find one consistency, namely, when the leak occurs and keeps eating up memory every time I end the iphlpsvc task ONLY the leak ceases immediately every time. Unfortunately, whatever memory has been used up is not released (without a PC reboot) but at least it ceases to rise. Now what upsets iphlpsvc on occasions I have NO IDEA

I did raise the issue on Sysnative Forums (https://www.sysnative.com/forums/win...ng-reboot.html) where I received some helpful advice on how to try track the leak further but regretfully I was not talented enough to trace the cause being a PC user not expert.

I then noted the IPhlpsvc was updated in one of the Win 10 updates and after that I did not get any leaks again and hoped the issue had been fixed BUT as I said, today its come back after weeks of no issue.

It would be interesting if you too end ONLY the iphelpsvc task via Task Manager when you see your leak is ongoing and see whether the leak stops immediately on your laptop (and like with me does to restore any used up memory). Although it will not be a solution it will confirm whether we both have the same issue.

By the way, I use Firefox and sometimes need to active the Adobe Flash player plug-in. Currently the flash plug-in is crashing every time with FF 50.02 RELEASE (unless I untick the "Enable Adobe Flash Protected Mode" option in the Plugin). Until the latest FF 50 and the latest Adobe Flash 23.0.0.207) I have not needed to do this for over a year. I have NO IDEA if either or both are involved in this memory leak (or a Firefox plug-in or addon, but today I have MOSTLY been using Firefox so I am suspicious there is some connection. I see iphlpsvc amongst other things is involved with Ipv6 and I am wondering if it only sometimes kicks in when maybe I go to a rare IPv6 site and Teredo Tunnelling maybe starts. I really am no expert at all on all, this so I may be surmising total rubbish.

I AM however suspicious I personally could work around my issue by Disabling the IPhlpsvc as I do not believe I need it on my setup (although I am unsure of its total use as information seems very limited on the Web and what it there is mostly beyond my real understanding.

Weeks ago I did experiment for 2 days by Disabling the IP Helper Service (default automatic) and got a Windows Event Viewer an Error message advising me the Network Connectivity Assistant Service (default Manual triggered) could not be run. After a very short investigation I found it is the only service that is dependent on the IP Helper Service so I disabled that as well. With both disabled on my setup I did NOT notice ANY ill effects or leaks (but it was only a 2 day trial). I reset them to their windows 10 Pro defaults on the 3rd day when (as I mentioned above) I noticed a Windows 10 update had changed the version number of IP Help Service and as I did not have any leaks in weeks until today, I though MY issue was resolved (regretfully not it seems).

Final comment. My System passes both sfc/scannow and the various DISM options. This has always been the case since Windows 10 was updated to the Anniversary version (admittedly I have only experienced a leak issue with Windows 10 Anniversary and never prior to it). I also never had a leak issues in 3 years with my previous Win 7 Ultimate (x64) O/S. I do not know if Win 10 Anniversary versions are partly (or completely) involved with this issue. The fact that there has been very little reporting on this issue I have to think its a combination of factors.

Sorry I cannot be of much help MacDonals, as am at a total loss myself.

UPDATE: have just seen this (have you MacDonals). http://en.community.dell.com/owners-...746/t/19991262

Regards

 

Thank you for your thoughts and links on this DKO. I left my laptop on overnight, woke up to 78% memory usage (I have 16GB). I stopped IP Helper and it looks like it isn't climbing any longer.

I will keep an eye on it during the day, but yeah this is still an issue.

 

I only have 8GB on my PC, so my memory usage issues occur twice as fast as yours. I find it interesting your memory increased overnight. My PC is always switched off at night. Maybe that will help you locate your issue as I assume, apart from Windows, not much is running overnight which could have triggered the memory leak. At least you know which of your apps did not trigger (unless they have aspect running in the background from Windows start-up. Does you PC always leak memory immediately from Windows start-up MacDonals or, do you go hours or days between leaks sometimes?

With MY leaks if I left my PC on overnight any IP Helper Service leak starting up would crash my PC within an hour or so even if Windows 10 automatically tried to protect memory by transferring some used up memory to my large Pagefile.sys file. If your leak started late at night or started soon after you left it for overnight and was only at 78% in the morning even accepting you have twice my memory then your leak seems much slower accumulating than mine unless, f course, the leak was only triggered a short while before you checked your laptop the next day.

I was having an issue with Adobe flash crashing on my Firefox 5O RELEASE Browser, everytime it need to be used by websites which was not happening when I was using FF 50 Beta. I thought this very curious). However I had made some changes as I use Free Download Manager which has a Firefox Plugin. Unfortunately, when I moved to FF 51 Beta the FDM plug-in would not work (needs new plug-in from the FDM developers). BEFORE I uninstalled FF51 Beta and installed FF50 RELEASE (which the FDM plug-in DOES work with) I tried out three other free Download Managers, namely Ninja Internet Download Manager, Eagleget and Flashgot. This, in my case was a mistake. Flashgot did not work with FF51 Beta and Eagleget was not suitable/stable enough for my needs. Ninja IDM seemed close to ideal (AT FIRST) but I quickly found it inconsistent and I could not make it consistent, so I gave up. Unfortunately Eagleget and Ninja do not fully remove all things and settings they installed when I uninstalled them (hate how many apps leave tentacles behind when using their official uninstallers. One file left behind, I found was almost impossible to remove (an Eagleget file I think it was). when I tied to delete it kept saying it was in use (how could that be the case when Eagleget was supposedly uninstalled. Makes you wonder!. I had to use a deleter app that has an option to wait to delete when PC next boots up BEFORE Windows starts up and start running the file. ANYWAY, I managed to remove it and other leftovers from Eagleget and Ninja IDM however Firefox and my PC did not seem quite a stable as usual and I could not identify any reason for random new small issues and new Windows event Viewer Errors AND (as I said earlier) Flash was crashing every time I needed it for a web page. I have no idea which of those download Managers upset Flash or vice versa or if separate issues but I could not clean up and sort out. Then as I reported in my last post, my PC started getting IP Helper Service memory leaks again after 4-6 several weeks of that not being an issue which was the final straw. Luckily for me I use Aomie Backupper Free regularly to backup my c: (System) Drive and I always keep several latest backups. I love Aomei Backupper Free (if you do not need Incremental backups then the Free version does everything most home users will ever need), that I used to pay for with Acronis True Image Home, which has a habit of invalidating paid for updates versions when Window released a new version of Windows. Nice for Acronis, but not for the Users who have to pay for an upgrade. Not only that, but I find Aomei more easy to use and more stable (to be fair Acronis TIH never failed to backup or restore properly in the years I used its versions but occasionally it would not open or close properly.

ANYWAY *Wink back on subject. I decided to bite the bullet and restore my 3rd most recent C: Drive (System) backup (about 4 weeks old) as I knew that backup was seeming totally stable and using FF50 Beta, adobe Flash plugin was working perfectly, the FDM plug-in was working perfectly, the backup was made BEFORE I had tried installing the 3 Download managers I mentioned AND MOST IMPORTANTLY I had not had ANY memory leaks for around two weeks at that time.

As soon as the Restore had completed I knew FF 50 Beta would try to auto update to FF51 Beta which I knew would stop the FDM plug-in from working so I quickly stopped it doing so and installed FF 50.02 RELEASE.

OK, now the Firefox Flash plug-in (same version) is working perfectly and has not crashed once in 2½ days. Firefox and my PC are all working smoothly as before without unusual random issues occurring AND in 2½ days SO FAR I have not sustained ANY memory leaking at all *Thumbs. (My memory usage with Firefox open is normally around 34% after hoiurs of PC usage (currently 35% after 10 hours of constant usage) of my 8GB memory. Firefox running with all my add-ons & plug-ins and running in the new Multi Processor mode accounts for around 4% to 6% of memory in use. Whan I first strat up PC memory usage is 21% approx and this slowly creeps up to around 28% and sticks around that level. I cannot explain that 7% gap. Seems to have something to do with how many hours I have used PC and how many things I have done on it during a session. Maybe Windows 10 sometimes automatically decides what to retain in memory and what to move to the pagefile.sys file. Anyway on my PC this is completely normal memory usage and behaviour for the Notification Tray apps and other apps running on my PC like Avast Anti Virus free from Windows start-up. It does not creep beyond mid 30 % UNLESS IP Helper Service memory leaks start (which I hasten to add have not occurred once in over 2½ days since I di my backup restore.

EDITED UPDATE: I found 4%-5% of the memory in use is associated with a Firefox add-on which keeps updates of all typing to web forms every 10mins or when there is a more than 20 chars change. Most gets saved to a file based database but some of the most recent updates are stored in memory as well. Anyway (however it works) when I cleared the database my memory reduced immediately by 4% and when I closed Firefox I was back to 26% memory in use.

I believe this backup restore has solved my memory leak and other issues (although reasons unknown). Unfortunately it will not resolve yours MacDonals, HOWEVER I can tell you that there has been no Microsoft updates made to my 4 weeks old restored backup which means the issue (on MY PC) was not caused by a Microsoft update as there have not been any to my PC since 9 Nov 16.

I don't know how recently your memory leak issues started. If very recently and you do regular backups, may I suggest try going back to a backup that was not affected by memory leaks and restore it. If you do not make backups then may I respectfully suggest Aomei Backupper Free if you have spare drive space (ideally a separate drive but if not then next best is a different partition on your Hard Drive).

I am lucky, as my Desktop PC has 2 internal drives and one (slowish) USB 2.0 external hard Drive so I have plenty of space tro keep up to 10 most recent backups of my C: (System) Drive (and my D: Date Drive) . Because I am a "Belt and Braces" type of guy (and have been burnt before *Sad) I keep a Word document updated history of ALL adjustments , tweaks, changes and new software I have installed or software that I have uninstall between each backup _ so I know exactly what I have done after every backup and in between each backup). I do not tend to make new backups based on days, but based on how many changes I have made since the last backup and also depending on whether they will be long/ or complicated to replicate if I restore a earlier specific backup.

With my memory leak issue and flash issues etc. this allowed me to restore a 4 weeks old 3 backups ago backup and know exactly what I needed to do to bring it back up to date. SUmo Updater (free) tells me which updates I need to re-apply (and I always save the latest software updates I have applied).

Sorry, if I am "Teaching Grandmother to suck eggs" MacDonals and you know or do all this anyway (may be of interest to PC novices). The really lovely thing about backups is, that as with THIS occasion I was able to go back to a stable backup made at a time before I had any of my very recent issues.

On a previous occasion several months ago having done a backup restore I was able to identify a specific software app update that triggered an issue on my PC by one by one repeating actions I had recorded since that backup and one by one processing updates I had made since that backup and checking for the issue to either (not reappear or reappear after each update WHICH IT DID after one of my updates so knew exactly which app update was the cause of the new issue. When I visited the author's support webpage I found the issue had already hit many others and the support team had acknowledged the issue and supplied a workaround until full resolution with a new update.
Of course if Users only do infrequent updates or tweaks to their PCs, then finding issues can be much easier to track down, but I have many apps, I always apply updates as soon as available and I make tweaks and adjustments so it is therefore very hard for me to know exactly when and what riggers any rare unexpected issue. Anyway MacDonals, trying a Restore of a stable Backup, made prior to an issue is much easier than a "Sledgehammer to crack a nut" approach of maybe needing to resort to a totally clean install of Windows 10 and having to reinstall all apps and then their updates again plus any User preferences, tweak or adjustments made - especially if one has only his/her memory to rely on on what actions/tweaks etc. were made after last clean install or major Update of Windows (e.g. Anniversary).

I think I have waffled more than enough for one post and have one off track slightly (be it for best of intentions)
Bye for now MacDonals
Regards,

 

I'm not using FireFox (although it is installed), so I don't believe that is the problem.

I disabled the IP Helper Service and so far that has worked like a charm. My modem and router do support IPv6, but do not require it. I'm behind NAT so this shouldn't bite me in the ass. By the time I embrace IPv6, this computer will be long gone *Wink

 

I agree that Firefox is almost certainly NOT implicated in any way with your memory leak issues. That fact is very helpful to me (maybe others) as it seems reasonable that FF is not involved in IP Helper Service memory leaks, nor its add-ons and plug-ins (which in my case would include the Flash plug-in and that would apply to all my FF add-ons including the Flash Player Plug-in).

I think in all honesty I'm suspecting this may be a MS Windows 10 issue, or one of its updates, which occurs given a certain set of circumstances, equipment or setup. As relatively few seem to have reported the issue, maybe it will not be high on MS priority to investigate. One thing that may resolve the memory leak issue IF it is Win 10 related is when the next major upgrade occurs. I base this possibility on some known issues being resolved when Win 10 Anniversary came out.

I'm delighted the disabling IP Helper Service workaround appears to have stopped your memory leaks, and is not appearing to cause you any issues MacDonals. Its always disappointing when Users have to resort to workarounds, but sometimes that's the only option for a speedy resolution. On this occasion the workaround seems not likely to affect barely any, as IPv6 uptake seems to be a very slow process (maybe by when we have a Windows 14 at this rate *Roflmao2).

 

Quick update on this. My laptop has been up and running for about a week while I traveled. I RDP into it from the road so it still gets use.

Since I disabled IPHELPER service the memory usage has not gone above 30% when idle and there seems to be no impact of disabling the service.

 

That's great news MacDonals thanks for the update. I too have not had any issues since my Aomei Backupper Standard Free backup restore over a week ago. In my case the IPHelper Service is still enabled so obviously something unknown that I did or installed after the backup date triggered my issues which I obviously have not repeated repeated after restoring the backup.

If my leak ever comes back I'd also disable IPHELPER service.

Shame we do not know the actual trigger and then it possibly could be addressed (if not a MS issue)