Runaway SVCHOST process

[ZWarrior]

Posting this so I remember it and others can learn from it.

I am having an issue where the process SVCHOST will eventually take up 100% of the CPU and grow in RAM use.  Obviously a memory leak is present, but as I troubleshot this I also found out about a cmd-line tool that would tell me what processes it is supporting.

I found this page that told me somethings about it and also said to run "tasklist /SVC" to get a list of the processes being supported. **Note - It should also tell you to add the PID column to the Processes tab for Task Manager to see which svchost is the one in question.

Here is the initial list from this time.

Image Name                 PID   Services
================  ===== ==========================================
svchost.exe                 1116 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
                                         EventSystem, FastUserSwitchingCompatibility,
                                         helpsvc, HidServ, lanmanserver,
                                         lanmanworkstation, Netman, Nla, RasMan,
                                         Schedule, seclogon, SENS, SharedAccess,
                                         ShellHWDetection, TapiSrv, Themes, TrkWks,
                                         winmgmt, wscsvc, wuauserv, WZCSVC

I noticed that this starts eventually, as long as Outlook is loaded, but if I sync my cellphone I can get a svchost.exe to load and start leaking quicker.

The quick fix is to close that process, but that tends to de-stabilize the PC.  Ultimately I have to just reboot the system to clear it out.  I will post more as I start to isolate this.

In the meantime I thought you might like to hear about tasklist.exe.

[ZWarrior]

Round two.  I come home tonight and my CPU is at 100%.  Let's see what the culprit's were...

svchost.exe          1124 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
                                 EventSystem, FastUserSwitchingCompatibility,
                                 helpsvc, HidServ, lanmanserver,
                                 lanmanworkstation, Netman, Nla, RasMan,
                                 Schedule, seclogon, SENS, SharedAccess,
                                 ShellHWDetection, TapiSrv, Themes, TrkWks,
                                 winmgmt, wscsvc, wuauserv, WZCSVC

Same exact processes from last time.  Guess I get to do some research on those processes.