Separate out a service from SVCHOST.exe (and Superfetch)

I have a runaway svchost.exe (service host) that is using 135 MB of memory.  I want to know what is using up the memory and whether I can separate it out into it's own service host, so I can watch it by itself.

Before Windows Vista and the later improvements in Task Manager, you would have to use a cmd window and tasklist.exe to find which services were being hosted by which service host.  Tasklist produces a list of all running processes:

Image Name               PID Session Name  Session#    Mem Usage
=================== ======== ============ ========= ============
System Idle Process        0 Services             0         24 K
System                     4 Services             0      1,612 K
smss.exe                 408 Services             0         88 K
csrss.exe                632 Services             0      1,944 K
csrss.exe                684 Console              1     69,172 K
wininit.exe              692 Services             0        112 K
winlogon.exe             756 Console              1      1,268 K
services.exe             796 Services             0      5,764 K
lsass.exe                804 Services             0      7,236 K
lsm.exe                  812 Services             0      1,624 K
svchost.exe              908 Services             0      4,416 K

Tasklist /svc returns all Services

Image Name              PID Services
===================== ===== ==========================================
System Idle Process       0 N/A
System                    4 N/A
smss.exe                408 N/A
csrss.exe               632 N/A
csrss.exe               684 N/A
wininit.exe             692 N/A
winlogon.exe            756 N/A
services.exe            796 N/A
lsass.exe               804 EFS, KeyIso, ProtectedStorage, SamSs
lsm.exe                 812 N/A
svchost.exe             908 DcomLaunch, PlugPlay, Power
svchost.exe             988 RpcEptMapper, RpcSs
svchost.exe             600 AudioSrv, Dhcp, eventlog,
                            HomeGroupProvider, lmhosts, wscsvc
svchost.exe             572 AudioEndpointBuilder, hidserv, Netman,
                            PcaSvc, SysMain, TrkWks, UxSms, Wlansvc,
                            wudfsvc
svchost.exe            1060 EventSystem, fdPHost, FontCache, netprofm,
                            nsi, SstpSvc, WdiServiceHost
svchost.exe            1120 AeLookupSvc, Appinfo, BITS, Browser,
                            EapHost, IKEEXT, iphlpsvc, LanmanServer,
                            ProfSvc, RasMan, Schedule, SENS,
                            ShellHWDetection, Themes, Winmgmt, wuauserv
svchost.exe            1196 gpsvc
TrustedInstaller.exe   1228 TrustedInstaller

PID 572 svchost.exe is running quite high.  If you find this svchost.exe in Task Manager, right click and choose Go To Service(s) then it will jump to the Services tab and highlight each of the services named on the right hand side.  [This is a great improvement over the poor TaskMan console in Windows XP (which could have easily been updated in a service release during the years that Windows XP was being sold.. Tho there were ways to replace TaskMan with improved versions manually.]

When I restart the service SysMain - Superfetch, the working memory used by this svchost process drops significantly.  So I want to run SysMain in its own process to watch it independently of the other processes.   To do this apparently I need to run:

sc config servicename type= own   there has to be a space after the type=.. so:

sc config SysMain type= own ... and running this gives me.. er.. failed.

[sc] OpenService failed 5

So if you get that, you don't have the elevated permission required to change the service.  Close the cmd window and run cmd as Administrator instead.  (Press the Start button and type 'cmd' then right click the cmd.exe when it appears, choose Run as Administrator from the context menu.)

Now it says:

[SC] ChangeServiceConfig SUCCESS

If you find the service in Regedit - HKLM\SYSTEM\CurrentControlSet\services\SysMain - you'll see that the Type REG_DWORD changes from 32 (0x100) to 16 (0x010) = shared and own respectively.

Restart the service.  Tasklist should now show the service has been placed in its own process - 22832.

Superfetch: this was introduced in Windows Vista.  It basically attempts to pre-empt which programs you use most frequently and then swap them in and out of the memory cache.  So what if you use the computer like me.. have 3 browser windows with a total of 25 tabs, two Visual Studio instances, Word, Regedit, Explorer, TaskMan, Excel all open at the same time..  I think Superfetch is running to its max and killing my system.  Now it's like working in treacle.  Could it be that what was designed as a 'performance enhancement' is actually unable to keep up under heavy usage?

Windows 7 has a program called Resource Monitor, which is an updated perfmon.exe  (Performance Monitor).  This is a useful program - you can select every instance of Chrome for example and see what all the windows are doing... I've got one process 12544 which is opening Cookies, my $LogFile.. my user data cache for Chrome.. and is connecting to the following:

lhr08s06-in-f9.1e100.net
sea15s02-in-f3.1e100.net
we-in-f189.1e100.net
collector.trendmd.com
lhr08s06-in-f14.1e100.net

[1e100 = 10 to the power of 100... which is a 'Googol'...]

I'm going to explore Chrome's own TaskMan to see what's running on that PID.. seems it is the main base browser instance and not any of the tabs.  Google keeping tabs on my usage...

I'm going to try living without Superfetch running for a bit... to see whether switching it off makes my laptop run any differently..

Google is so slow...

I appear to be waiting too long for Google to return results .. or for the page to complete...

In the late evenings when searching for general images, all I see is a grid of grey boxes... Sometimes the page doesn't change... I have to hit Enter on the URL 1-4 times before the browser even appears to react... and after a few minutes of working with Google Maps tiles stop loading and the whole thing comes to a halt...

Switch to Bing / Yahoo / Multimap / Streetmap.co.uk and there's no problem...

Why is Google slowing down? It's not just me... I did have Chrome Dev installed.. so i removed it from my system completely and reinstalled... and I still have problems... It happens on my spare laptop... so it's not my computer... I no longer have any plugins because I clean-installed Chrome...

DNS? - On my router, I'm using Google DNS - 8.8.8.8 and 8.8.4.4
Everything we do on the internet requires some DNS lookup... I just ran Ping on a few DNS servers... checking the average of 20 pings... (all 0% loss)

For 8.8.8.8 and 8.8.4.4 Google DNS
Minimum = 31ms, Maximum = 33ms, Average = 31ms
Minimum = 30ms, Maximum = 32ms, Average = 30ms

For 208.67.222.222 OpenDNS
Minimum = 23ms, Maximum = 26ms, Average = 24ms

For 212.159.13.49 and 212.159.13.50: My ISP
Minimum = 24ms, Maximum = 31ms, Average = 24ms
Minimum = 25ms, Maximum = 34ms, Average = 26ms

Google DNS promises speed and other functionality... by comparison .. I don't see it.. and I reckon by other functionality - they mean they can track where I go and what I do... and improve Analytics for websites and which AdWords are targeted at me throughout the day...

Only 4 hours ago I also ran the DNS test.. but deleted the results... the average was 70ms with minimum ~50ms and max ~180ms... This was the same for Open DNS... and I didn't test my ISP in time. I was distracted by trying to work out whether I should move myself off the antique Broadband Package I am on and onto a new one... the up-to-date candidate package looks very similar - there's a very complicated hour versus service rate limiting chart to confuse me even further...

http://portal.plus.net/support/broadband/speed_guide/download_speeds.shtml#extraSpeeds
http://portal.plus.net/support/broadband/products/archive/bbyw/speed.shtml#Option2speeds

Looks like I'm on the better deal by a small margin...

I switched my DNS back to my ISP's name servers.... I don't think Google DNS is beneficial at all in the UK yet...  Has it helped?

Things appear faster... but it's early morning .. and one of those things with IT that it's the experience over the full 24 hours that counts... whether there's an impact at the times at which I work throughout the day... and on the work I am doing (VPN, VNC, RDP, HTTP, HTTPS, etc...)

If it makes no difference then I'm going to try switching off Web History and other tracking components... and clearing my Google History out... if we can...