3

First off:

  • Windows 10 Professional build 17134
  • Intel i5-6500 3.2GHz
  • 8GB DDR4 RAM
  • MSI GeForce GTX1070 8GB

So for the past two weeks I've been having problems with my Windows 10 Pro machine:

  • Applications will start to give errors, usually memory related
  • Chrome won't work anymore
  • Task Manager won't open
  • Suddenly both my screens turn black
  • Computer is completely frozen on the black screen, I can't do anything and no sounds or anything play (Ctrl+Alt+Del, Ctrl+Shift+Esc, Alt+Tab don't work)

All that's left for me to do is to hard reboot my PC.

So I've been digging around, trying to find out what was going on. The Event View told me something was wrong with my memory. Still, there was nothing related to the crash, simply that my page file is full. There's some warning about applications timing out and memory running out, then nothing until I restart my PC. Here's a dump of the last few logs from the Event Viewer.

So here's what I tried

  • Ran a Windows Defender offline scan
  • Used MalwareBytes to scan my PC
  • Updated my GPU drivers
  • Updated my BIOS (as told by Microsoft support)
  • Increased the Pagefile from max 16GB to max 24GB (I have 8GB physically)
  • Ran "DISM.exe /Online /Cleanup-image /Restorehealth" and "sfc /scannow", found and fixed some errors, problems persist
  • Ran MemTest86, no errors found

I then decided to keep the Resource Monitor open and when I came back to my PC a while later I noticed it had pretty much frozen, but I could still see the Resource Monitor. Everything seemed to be normal but "taskhostw.exe" was using up 24GB of memory!

So that explains why I kept getting memory errors and why my pagefile was filling up. Any fix for this?

Edit:

I managed to find the process in Process Explorer, here's what it showed:

Screenshot of process

Any ideas on how to troubleshoot further?

Community
  • 1
s1h4d0w
  • 288
  • 2
  • 16
  • Possible duplicate of: https://superuser.com/questions/1192091/how-to-diagnose-abnormal-cpu-usage-by-svchost-exe/1192108#1192108 – Ramhound Oct 09 '18 at 14:37
  • @Ramhound That's actually really helpful, thanks. Will try that when it happens again. – s1h4d0w Oct 10 '18 at 13:45
  • Once again we are always glad to help, but it would be ideal if you did us the professional courtesy of replying to our comments, rather than simply [delete your question](https://superuser.com/questions/1390246/windows-does-not-recognize-chrome-as-a-browser) without a single word of explanation. – Run5k Jan 03 '19 at 17:51
  • That’s because reinstalling worked. I deleted it and only then realized that I hadn’t commented back, but after deletion you can’t comment anymore. – s1h4d0w Jan 05 '19 at 10:00
  • For future reference, the proper thing to do would be either asking DavidPostill to submit an answer that has reinstalling Chrome (since he originally suggested it) as the solution, or submit the answer yourself. The question was essentially solved, so why delete it? Taking feedback from the community, solving your problem, and then actually *deleting* your question (without providing **any** feedback) probably isn't going to earn you too many friends within the Super User community. – Run5k Jan 05 '19 at 13:07
  • ...and at the risk of stating the obvious, please remember that you can still utilize the **undelete** capability to revive that question, answer the comments that were posted, and ask DavidPostill to submit an answer. That would probably be the right thing to do. – Run5k Jan 05 '19 at 20:23

2 Answers2

2

taskhostw is the container that runs system services, of which there are dozens of instances running on your computer.

It does not help to update drivers and the operating system blindly. You need to analyze which system service is using the CPU.

This is complicated by the fact that each taskhostw instance may house several system services.

See this answer to see how to analyze which taskhostw instance is causing the problem, then how to separate all the system services it supports into separate taskhostw instances.

Once you know the exact system service that is the root of the problem, let us know for further advice.

If it's hard to find the cause once the system is paralyzed, in similar cases I have added to Task Manager Details view the column "Working set (memory)" and sorted the display by it, then left it on the screen.

Most times you will see memory usage climbing and be able to identify the process before the freeze, then right-click it and do "Go to service(s)". Remember that one such process may contain other services further down the list. If there is more than one, execute the above-linked procedure to separate them, until you find just the one service.

harrymc
  • 455,459
  • 31
  • 526
  • 924
  • Donvoted. Why ? – harrymc Oct 02 '18 at 18:07
  • I wasn't the one to downvote. The problem is, by the time I can actually see which service is actually causing the problem it's often too late because my PC will have frozen up and nothing will work anymore. I've been keeping tabs on it with the Resource Monitor but everything seems to be normal, then suddenly spike and freeze the PC. Are there any logs I can access? – s1h4d0w Oct 02 '18 at 20:58
  • Downvotes are a mystery I have yet to understand. I extended my answer above. – harrymc Oct 03 '18 at 07:44
  • I've added a screenshot of Process Explorer to my post, could you take a look? It shows a few threads but I don't know how to follow it to anything specific. – s1h4d0w Oct 09 '18 at 14:29
  • Could you add a screenshot of the Image tab? – harrymc Oct 09 '18 at 14:34
  • I will when it happens again. Another user commented on the original question too, linking a way to see which services are running inside the problematic taskhostw instance, will be trying that too. – s1h4d0w Oct 10 '18 at 13:46
  • That other user pointed to another answer of mine, and the link is included in this answer as well. – harrymc Oct 10 '18 at 14:01
  • Oh wow you're right. I have no idea how I missed that, all props to you. – s1h4d0w Oct 10 '18 at 14:03
  • Sadly it didn't work. It only shows two results for taskhostw.exe and both have "N/A" in the Services column: https://i.imgur.com/XTyDfpC.png – s1h4d0w Oct 11 '18 at 09:19
  • Were you running it as Administrator? – harrymc Oct 11 '18 at 09:33
  • I was, just tried it again because my PC froze again and same result. I can also easily kill the process in taskmanager without anything bad happening to my PC, everything just starts to work fine again. – s1h4d0w Oct 14 '18 at 09:09
  • Next time it happens, can you go into Process Explorer, double-click on the process and take a screenshot of the Image tab. – harrymc Oct 14 '18 at 09:30
  • Finally happened again where I managed to run Process Explorer without the screen going black. I've just screenshotted everything that looked interesting and made dumps of the environment and strings tabs. Here's all of it: https://1drv.ms/f/s!Avyp56OD9ca2hv9du174upUQO1l6_Q – s1h4d0w Oct 16 '18 at 21:24
  • I can't see anything wrong. Something is wrong, but the cause is unknown. As you say that SFC and DISM have found and fixed some errors, it might be safer to ensure coherence by resetting everything to a known state with the [Repair Install of Windows 10 with an In-place Upgrade](https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html). Take good backups first, perhaps also a system image with a boot CD/USB and try it to ensure it can see the backup media. – harrymc Oct 17 '18 at 07:45
  • My favorite backup product is [AOMEI Backupper Freeware](https://www.google.fr/search?client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&hl=en-FR&source=hp&biw=&bih=&q=AOMEI+Backupper+Freeware&btnG=Google+Search&gbv=1). – harrymc Oct 17 '18 at 07:45
  • Might try that out but want to keep on looking for a bit more. I decided to kill the threads shown in Process Explorer one by one to see if I can get a little bit further. Coincidentally the last thread finally made the RAM consumption go down, so next time it happens I'll try a different order of killing them and seeing if I can pinpoint a specific thread. – s1h4d0w Oct 19 '18 at 14:04
  • Good luck. Sounds interesting. – harrymc Oct 20 '18 at 10:48
  • @s1h4d0w any luck? Having the EXACT issue you are. I can start my own diagnosing, but if you already solved it, would appreciate the point in the right direction. Cheers – Antiga Nov 27 '18 at 06:41
  • @Antiga I wish but sadly no. It’s still happening and I haven’t been able to find anything. Process Explorer doesn’t show any relevant threads, I’ve ran my virus scanner multiple times and it still just randomly starts eating my RAM. It’s incredibly annoying. – s1h4d0w Nov 28 '18 at 12:12
  • My answer is incorrect for your case. Please check in Process Explorer if the process is really `c:\Windows\System32\taskhostw.exe` or from somewhere else. Let me know if you have a task called `Updatechecker.exe` running ([link](https://www.bleepingcomputer.com/virus-removal/remove-taskhostw.exe-and-windows-update-checker-miner)). – harrymc Nov 28 '18 at 14:01
  • @harrymc sorry for the late reply, I missed your comment. The process is definitely taskhostw.exe. Task manager says it's that in the Processes tab, in the Details tab and Process Explorer also says it's taskhostw.exe. I've checked the path that your link said would contain the Updatechecker.exe but I don't have the WindowsUpdate folder inside my `%UserProfile%\AppData\Local\Microsoft\` folder. I've tried analyzing a dump of the process but can't make sense of it. – s1h4d0w Dec 02 '18 at 11:50
  • The only advice I have left to give is to do [Repair Install with an In-place Upgrade](https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html). – harrymc Dec 02 '18 at 11:58
  • @Antiga I might have found the problem, check the answer I've added: https://superuser.com/a/1380378/406752 – s1h4d0w Dec 03 '18 at 11:09
1

Possible answer:

Today I used Process Explorer again to check out the process that was eating up my memory. Because this problem has been going on for months I now have the habit to check my task manager everytime I start to use my PC. And what do you know, taskhostw.exe was up to it's old tricks, but was only using about 4GB of RAM instead of 22GB. It was also putting 25-30% load on my CPU, which was new.

This time I noticed the "Parent" of the process, which said svhost and a PID. I used that to find the corresponding service, which was "Schedule". I started googling some random stuff related to task scheduler and taskhostw and svhost. There I completely randomly stumbled upon a post on the Microsoft community about the StorageSense task.

That was something, but I wasn't sure if that was it. Looking at the threads in Process Explorer again I suddenly saw a 5th thread that I hadn't seen before. It was named StorageUsage.dll!GetStorageUsageInfo and was the exact thread the poster on the Microsoft community had.

My speculation is that the process keeps asking for more and more memory, which eventually gets the process itself in trouble and kills off the StorageUsage thread. My own tests seem to confirm this, because if I kill the StorageUsage thread and leave the other be the process stops using my CPU for 25-30% but the RAM usage stays the same. By killing the Storage thread the process suddenly looks exactly as when I find it when my PC is starting to freeze, no CPU usage and a load of RAM in use.

I've disabled the task, let's hope this works! If this does indeed help I'll be sending in a ticket to Microsoft as this seems like their doing.

Community
  • 1
s1h4d0w
  • 288
  • 2
  • 16
  • Still seems like this problem lingers in 2020. Here is a link to the relevant MS thread https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/taskhostwexe-issues-result-in-high-cpu-usage/40262b58-b5f3-44d3-ab76-b0991ed70fa0 To give an idea how bad the leak is typically it will eat 4GB of ram in about 3minutes – EdL Apr 23 '20 at 11:15