Runaway push notification process using multiple GB of memory

We are volunteers willing to help you try to resolve this issue.

The Windows Push Notification Services (WNS) enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.

1. Have been able to get a hint about which App might be running and causing the issue?

Start - Settings - type in --> Notifications
Or Start - Settings - System - Notifcations

See if turning off ALL notifications or even particular ones stop the problem.

2. While that is showing Right Click the Taskbar - Task Manager - find it and if there is a little arrow on the left expand it to see what is causing it to run.

3. Try Process Explorer while it is running to also see if that help determine cause.

If needed you can also try a Clean Boot.

Try the Clean Boot method to see if a startup program is involved - if so it is a process of elimination :

Right Click the start button - Command Prompt (Admin) - at the prompt type in

MSCONFIG

and hit enter

How to perform a clean boot in Windows
https://support.microsoft.com/en-us/kb/929135

Other programs to help :

Autoruns - Free - See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.
http://technet.microsoft.com/en-us/sysinternals...

Process Explorer - Free - Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.
http://technet.microsoft.com/en-us/sysinternals...

Please let us know the results and if you need further assistance.

1. Have been able to get a hint about which App might be running and causing the issue? 

Start - Settings - type in --> Notifications 
Or Start - Settings - System - Notifcations 

See if turning off ALL notifications or even particular ones stop the problem. 

Even with "get notificaitons from apps and other senders" and all the other toggles in "notifications & actions" turned off, it still does that.

When I scroll down to "get notifications from these senders" I just get the spinning dots (left it running for several minutes without it displaying any apps).

2. While that is showing Right Click the Taskbar - Task Manager - find it and if there is a little arrow on the left expand it to see what is causing it to run. 

The process says "Service Host: Windows Push Notifications User Service_49b3a" and when you click the arrow next to it a sub entry of "Windows Push Notifications User Services_49b3a" shows up.

3. Try Process Explorer while it is running to also see if that help determine cause. 

Process Explorer says the hog is svchost.exe using 20,xxx,xxx k private bytes, 9,xxx,xxx k working set and 12.xx cpu.

If needed you can also try a Clean Boot. 

No luck with clean boot.  Still happens with all non-microsoft services disabled as well as all startup items disabled.

Autoruns 

Just installed and ran it.  Not really sure what I'm looking for on it that is not in the task manager startup list.  Nothing really jumps out as being inappropriate.

Autoruns helps you find startups and stop them if needed so not needed here.

Can you expand that entry in Process Explorer to see the cause? Also right click -> Properties on any entry to see more.

Try letting the "Get notifications...." spin a little longer.

-------------

If using a 3rd party antivirus please fully uninstall it and Malwarebytes and then run its maker's removal tool to prevent trouble causing remnants. Use Windows Defender which in Windows 10 is a full antivirus and the FCU adds new protection such as Exploit and Controlled Folders.

List of anti-malware program cleanup/uninstall tools
http://answers.microsoft.com/en-us/protect/wiki...

Uninstallers (removal tools) for common antivirus software
http://kb.eset.com/esetkb/index?page=content&am...

After resolution of this issue I recommend using Malwarebytes as an on-demand scanner (not running all the time).

------------

Do these and then try "Get notifications...." again.

Windows Key + X - Command Prompt (Admin) OR Windows PowerShell (Admin)

(Run these one line at a time.)

SFC /scannow

Note if that shows uncorrected errors - continue regardless.

When that completes run these :

DISM /Online /Cleanup-Image /CheckHealth

DISM /online /cleanup-image /scanhealth

DISM /online /cleanup-image /restorehealth

Note if that shows any uncorrected errors - continue regardless.

Then restart the computer.

Please let us know the results and if you require further assistance.

Can you expand that entry in Process Explorer to see the cause? Also right click -> Properties on any entry to see more. 

In Process Explorer there is no expand + or > option next to the runaway svchost.exe.  It is under services.exe and that is under wininit.exe.

Under properties I get path:
c:\Windows\System32\svchost.exe

command line:

c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService

current directory:

C:\Windows\System32\

Autostart location:

HKLM\System\CurrentControlSet\Services\WpnUserService_49b3a

There are a lot of items in the properties, anything I should be looking out for?

Try letting the "Get notifications...." spin a little longer. 

I did not realize this before I posted last time, but apparently no amount of letting it spin will work.  Eventually the process uses all available memory and I get a pop-up box informing me I need to restart my computer because I am out of memory.  My fans crank up for awhile, then the drops the amount of memory used, fans go back to idling, and my settings window resets back to the main control panel view.  (Then the memory use will start climbing again.)

If using a 3rd party antivirus please fully uninstall it and Malwarebytes and then run its maker's removal tool to prevent trouble causing remnants. Use Windows Defender which in Windows 10 is a full antivirus and the FCU adds new protection such as Exploit and Controlled Folders. 

No 3rd party antivirus was installed.  Malwarebytes was only installed after this issue had been occurring for a couple of weeks.  Uninstalled it and ran the cleaner anyway.

SFC /scannow 

PS C:\WINDOWS\system32> SFC /scannow

Beginning system scan.  This process will take some time.


Windows Resource Protection could not perform the requested operation.

DISM /Online /Cleanup-Image /CheckHealth 

PS C:\WINDOWS\system32> DISM /Online /Cleanup-Image /CheckHealth

Deployment Image Servicing and Management tool
Version: 10.0.15063.0

Image Version: 10.0.15063.0

No component store corruption detected.
The operation completed successfully.

DISM /online /cleanup-image /scanhealth 

PS C:\WINDOWS\system32> DISM /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.15063.0

Image Version: 10.0.15063.0

[==                         5.0%                           ]
Error: 1009

The configuration registry database is corrupt.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

DISM /online /cleanup-image /restorehealth 

PS C:\WINDOWS\system32> DISM /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.15063.0

Image Version: 10.0.15063.0

[==                         4.5%                           ]
Error: 1009

The configuration registry database is corrupt.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

I can include the log if you'd like, but it's a bit big to just copy-paste into here.

To be clear, the issue is still occurring after the reboot.

1st check the drive for errors :

File Explorer - Right Click the hard drive (usually C: ) - Properties - Tools tab - Error Checking - Check.

How to Check a Drive for Errors in Windows 10
http://www.tenforums.com/tutorials/40734-drive-...

If that completes and corrects any errors found run SFC and DISM again.

If you still get the DISM errors I would do a Reset and keep files - note what it removes in this How To..

Refresh is part of reset in Windows 10
http://windows.microsoft.com/en-us/windows-10/r...

===

If needed you might have to perform a Clean Install which would also update you to the latest 1709 version of Windows 10.

If you do a Clean Install then it would be activated with the Digital Entitlement.

Start fresh with a clean installation of Windows 10
https://www.microsoft.com/en-us/software-downlo...

Clean Install Windows 10
http://answers.microsoft.com/en-us/windows/wiki...

Please let us know the results and we are here to help.

No errors on the drive check.  I'll do a refresh later today.

Tried doing a refresh and it told me after rebooting that there was an error and the refresh could not be done and no changes were made.

I'll work on the clean install next.

Yes my concern is this is just the first of what might be many errors associated with some sort of OS corruption. So I too would do the Clean Install.

Interesting development.  I have not done the clean install, but the error stopped occurring (for now, I am going to keep monitoring).  I decided to use this opportunity to see if I could finally go find the list of apps that send notifications.  I went to the "get notifications from these senders" list which previously just spun forever and now it loads this time... empty.  It just says "No senders have provided notifications yet".

I will probably still go ahead with the clean install, but I want to let this sit through a couple of reboot/use cycles and see if it persists for now.