• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 342
  • Last Modified:

svhost.exe taking too much memory

Hello Experts!
I have a remote computer with svhost taking too much memory. No tech people there.

Usually I would restart in safe mode and execute

But now its a remote pc....
Please your advice on this... need to do it remotely
Is there any other App that I do not need to safe mode?
2 Solutions
Dave BaldwinFixer of ProblemsCommented:
I don't think you can do it remotely.  It seems like a lof people are having this problem this week.
Yes, you can do it remotely with psexec from pstools.


psexec \\pcnameOrip cmd

This will put you in a command prompt on the remote machine where you can run executables. Or, you could do one at a time

psexec \\pcnameOrip fix_svchost
psexec \\pcnameOrip windowsupdateagent30-x86
psexec \\pcnameOrip WindowsXP-KB927891-v3-x86-ENU

EDIT: You can add these switches after psexec: the -i switch to run in interactive mode and the -s switch to run under System account.

For more info, run psexec /?
RGuillermoProject ManagerAuthor Commented:
Is there any way to turn on the remote computer in safe mode (nobody is there in a couple of weeks) and remember the ip is dynamic so how would you do this ?
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Step One:
 Back up the boot.ini contents.
 1) Right-click My Computer --> Properties
 2) Click the Advanced Tab
 3) Click Settings under Startup and Recovery
 4) Click Edit under System startup
 5) Click File --> Save As and save the file as a backup wherever you'd like.
 6) Then close the Notepad file and the dialog boxes.

 Step Two:
 1) Start --> Run
 2) Type msconfig
 3) Click the boot.ini tab and select the checkbox for /SAFEBOOT and the radio button for Network
 4) Click Apply
 5) Click the Services tab and click the VNC Server checkbox
 6) Click Apply
 7) Click Ok

Step 3:
psexec \pcOrIP shutdown -m \\computername -r -f

Even if it is dynamic it might keep the same IP in between reboots. Can you verify?Sometimes a DHCP lease will last at least a few days.

Also, have you tried seeing if those commands work while not in safe mode? The -s and -I switches are pretty powerful as far as system access goes.

 How do you know the IP to begin with?

It doesn't have to be a tech person - anyone can run ipconfig and tell you or copy and paste what it says.
you should investigate svchost issue instead of trying to remove it without understanding.
svchost is a "container" that is used to run some other process as a service.
It has been used in the past as a container for malware and viruses.

Check this article:

(It is almost correct except when it says that if the dll is in \window\system32 it is not a virus... It would be rare but not impossible.)

Use the techniques to identify which service using svchost is involved and tune it (or disable it if it is unwanted)
RGuillermoProject ManagerAuthor Commented:
Vivigatt, thanks I am studying.

ZamZ0, not only I don´t have tech people there I don´t have any people at all for a few weeks, so I am doing my best to recover the speed of that pc without messing it all.

I am testing all the infor you both sent me...
Will be back with results asap
Thank you!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now