And I can't reboot this server. Is there some way to know which svchost PID
is linked to which service so I know which one it's safe to kill?

In news:%23HdQEeBoIHA.6096@TK2MSFTNGP06.phx.gbl,
- <-> typed:
> And I can't reboot this server. Is there some way to know which
> svchost PID is linked to which service so I know which one it's safe
> to kill?

You'll need to install Process Explorer:
http://www.bleepingcomputer.com/tuto...torial129.html

You can also use PSKill to kill a process too, but at this point if it is in
a hung state, push and hold the power button until it shuts down. Not much
else you can do when it is in the middle of a shutdown.

--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
MVP Microsoft MVP - Directory Services
Microsoft Certified Trainer

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Infinite Diversities in Infinite Combinations

Thanks Ace,

That did the trick. I have used Process Explorer in the past but didn't
know it had this capability. It would be nice if threads didn't share
executables, but c'est la vie.

Cheers

"Ace Fekay [MVP]" <PleaseAskMe@SomeDomain.com> wrote in message
news:%23qAxTOCoIHA.4024@TK2MSFTNGP06.phx.gbl...
> In news:%23HdQEeBoIHA.6096@TK2MSFTNGP06.phx.gbl,
> - <-> typed:
>> And I can't reboot this server. Is there some way to know which
>> svchost PID is linked to which service so I know which one it's safe
>> to kill?
>
> You'll need to install Process Explorer:
> http://www.bleepingcomputer.com/tuto...torial129.html
>
> You can also use PSKill to kill a process too, but at this point if it is
> in a hung state, push and hold the power button until it shuts down. Not
> much else you can do when it is in the middle of a shutdown.
>
> --
> Regards,
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
> MVP Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Infinite Diversities in Infinite Combinations
>

In news:e47dBMKoIHA.2208@TK2MSFTNGP04.phx.gbl,
- <-> typed:
> Thanks Ace,
>
> That did the trick. I have used Process Explorer in the past but
> didn't know it had this capability. It would be nice if threads
> didn't share executables, but c'est la vie.
>
> Cheers

I agree. That's how malicious processes can hide under the svchost.exe as
well as others that can hide and run under winlogon.exe, which is a nastier
bug but can be found using Process Explorer.

Cheers!
Ace