svhost.exe taking too much memory

Hello Experts!
I have a remote computer with svhost taking too much memory. No tech people there.

Usually I would restart in safe mode and execute
1_fix_svchost
2_windowsupdateagent30-x86
3_WindowsXP-KB927891-v3-x86-ENU

But now its a remote pc....
Please your advice on this... need to do it remotely
Is there any other App that I do not need to safe mode?
Regards,
RGuillermoProject ManagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave BaldwinFixer of ProblemsCommented:
I don't think you can do it remotely.  It seems like a lof people are having this problem this week.
0
ZamZ0Commented:
Yes, you can do it remotely with psexec from pstools.

http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

psexec \\pcnameOrip cmd

This will put you in a command prompt on the remote machine where you can run executables. Or, you could do one at a time

psexec \\pcnameOrip fix_svchost
psexec \\pcnameOrip windowsupdateagent30-x86
psexec \\pcnameOrip WindowsXP-KB927891-v3-x86-ENU

EDIT: You can add these switches after psexec: the -i switch to run in interactive mode and the -s switch to run under System account.

For more info, run psexec /?
0
RGuillermoProject ManagerAuthor Commented:
ZamZ0,
Is there any way to turn on the remote computer in safe mode (nobody is there in a couple of weeks) and remember the ip is dynamic so how would you do this ?
0
Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

ZamZ0Commented:
Step One:
 Back up the boot.ini contents.
 1) Right-click My Computer --> Properties
 2) Click the Advanced Tab
 3) Click Settings under Startup and Recovery
 4) Click Edit under System startup
 5) Click File --> Save As and save the file as a backup wherever you'd like.
 6) Then close the Notepad file and the dialog boxes.

 Step Two:
 1) Start --> Run
 2) Type msconfig
 3) Click the boot.ini tab and select the checkbox for /SAFEBOOT and the radio button for Network
 4) Click Apply
 5) Click the Services tab and click the VNC Server checkbox
 6) Click Apply
 7) Click Ok

Step 3:
psexec \pcOrIP shutdown -m \\computername -r -f

Even if it is dynamic it might keep the same IP in between reboots. Can you verify?Sometimes a DHCP lease will last at least a few days.

Also, have you tried seeing if those commands work while not in safe mode? The -s and -I switches are pretty powerful as far as system access goes.

 How do you know the IP to begin with?

It doesn't have to be a tech person - anyone can run ipconfig and tell you or copy and paste what it says.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
vivigattCommented:
you should investigate svchost issue instead of trying to remove it without understanding.
svchost is a "container" that is used to run some other process as a service.
It has been used in the past as a container for malware and viruses.

Check this article:
http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

(It is almost correct except when it says that if the dll is in \window\system32 it is not a virus... It would be rare but not impossible.)

Use the techniques to identify which service using svchost is involved and tune it (or disable it if it is unwanted)
0
RGuillermoProject ManagerAuthor Commented:
Vivigatt, thanks I am studying.

ZamZ0, not only I don´t have tech people there I don´t have any people at all for a few weeks, so I am doing my best to recover the speed of that pc without messing it all.

I am testing all the infor you both sent me...
Will be back with results asap
Thank you!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.