More help/advice need I am afraid.
Couldn't locate sysinternals etc, but followed the excellent article linked by BOAC.
Found one svchost activity using considerably more RAM than any other (48,824K - over twice as much as any otehrs) but virtually no CPU activity (despite displaying 'all users').
Under 'Services' the process listed:
wudfsvc (Windows Driver Foundation - user mode Driver Framework)
WPDBusEnum (Portable Device Enumerator Service)
Wlansvc (Wlan Autoconfig)
WdiSystem (Diagnostic System Host)
UxSms (Desktop Window Manager Session Manager)
TrkWks (Distributed Link Tracking Client)
Tablet Input (Tablet PC Input Service)
Sysmain (Superfetch)
Pca Svc (Program Compatability Assistant Service)
Netman (Network Connections)
Hidserv (Human Interface Device Access)
EMDMgmt (Readyboost)
Audio Endpoint (Windows Audio Endpoint Builder)
All above show: PID1116 Running LocalSystemNetworkRestricted
Frankly mneans little to me - am moving well out of my comfort zone.
Any more ideas ?