none
svchost, likely MpsSvc consuming 90%+ memory on power up

    Question

  • I have an issue with a possible memory leak, assumed in MpsSvc. The issue is on a power up boot. I can kill the process in task manager or simply (soft) reboot to fix.

    I created a quick batch file to see the processes that spawn svchost and dump it to a log/txt file when I see the issue (always on first boot): 

    Tue 01/01/2013
    06:07 PM

    Image Name                     PID Services                                   
    ========================= ======== ============================================
    svchost.exe                    764 DcomLaunch, PlugPlay, Power                
    svchost.exe                    844 RpcEptMapper, RpcSs                        
    svchost.exe                    972 AudioSrv, Dhcp, eventlog, lmhosts          
    svchost.exe                    248 AudioEndpointBuilder, CscService, hidserv, 
                                       IPBusEnum, Netman, PcaSvc, TrkWks,         
                                       UmRdpService, UxSms, WdiSystemHost         
    svchost.exe                    416 AeLookupSvc, Appinfo, Browser, CertPropSvc,
                                       gpsvc, IKEEXT, iphlpsvc, LanmanServer,     
                                       MMCSS, ProfSvc, Schedule, SENS, SessionEnv,
                                       ShellHWDetection, Themes, Winmgmt          
    svchost.exe                   1032 EventSystem, fdPHost, netprofm, nsi,       
                                       W32Time, WdiServiceHost, WinHttpAutoProxySv
    svchost.exe                   1128 CryptSvc, Dnscache, LanmanWorkstation,     
                                       NlaSvc, TermService                        
    svchost.exe                   1416 BFE, DPS, MpsSvc                           
    svchost.exe                   1168 SysMain                                    
    svchost.exe                   3548 PolicyAgent                                
    svchost.exe                   2028 FontCache, SSDPSRV                         
    ===================================================================
    .
    Wed 01/09/2013
    09:19 AM

    Image Name                     PID Services                                   
    ========================= ======== ============================================
    svchost.exe                    752 DcomLaunch, PlugPlay, Power                
    svchost.exe                    836 RpcEptMapper, RpcSs                        
    svchost.exe                    968 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc  
    svchost.exe                   1000 AudioEndpointBuilder, CscService, hidserv, 
                                       IPBusEnum, Netman, PcaSvc, TrkWks,         
                                       UmRdpService, UxSms, WdiSystemHost         
    svchost.exe                    128 AeLookupSvc, Appinfo, Browser, CertPropSvc,
                                       gpsvc, IKEEXT, iphlpsvc, LanmanServer,     
                                       MMCSS, ProfSvc, Schedule, SENS, SessionEnv,
                                       ShellHWDetection, Themes, Winmgmt, wuauserv
    svchost.exe                   1028 EventSystem, fdPHost, netprofm, nsi,       
                                       W32Time, WdiServiceHost, WinHttpAutoProxySv
    svchost.exe                   1204 CryptSvc, Dnscache, LanmanWorkstation,     
                                       NlaSvc, TermService                        
    svchost.exe                   1420 BFE, DPS                                   
    svchost.exe                   1580 SysMain                                    
    svchost.exe                   3468 PolicyAgent                                
    svchost.exe                   2880 FontCache, SSDPSRV, wcncsvc                
    svchost.exe                   5176 WerSvc                                     
    ===================================================================
    .

    Note PIC 1416 in the first and 1420 in the second.

    I'd like to find out what is causing the memory leak, and more to the point, how, other than a reboot, to stop it.

    TIA,

    Joe

    Wednesday, January 09, 2013 4:21 PM

Answers