Autohotkey unable to kill a process - winapi

Question

I have facing some issues with svchost going out of control at times and making my system unstable. Mostly i just kill it manually, but i decided to write an AHK script to do that automatically everytime if starts using too much memory.
#NoEnv ; Recommended for performance and compatibility with future AutoHotkey releases.
#Warn ; Enable warnings to assist with detecting common errors.
#SingleInstance force
;--------------------------------------------------------------
; Variables
;--------------------------------------------------------------
minMemMB = 200
minCPUPercentage = 50
Loop
{
for process in ComObjGet("winmgmts:").ExecQuery("Select IDProcess, PercentProcessorTime, WorkingSet from Win32_PerfFormattedData_PerfProc_Process where Name like '%svchost%'")
PID = % process.IDProcess
CPU = % process.PercentProcessorTime
MEM = % Round(process.WorkingSet/1000000)
FormatTime, TIME
if (CPU > minCPUPercentage or MEM > minMemMB)
{
Process, Close, %PID%
sleep, 2000
if ErrorLevel = %PID%
FileAppend,
(
Killed, %PID% , %CPU% , %MEM%, %TIME% `r`n
), log.csv
else
FileAppend,
(
Failed, %PID% , %CPU% , %MEM%, %TIME% `r`n
), log.csv
}
}
My code works fine in identifying when svchost has exceeded the accepted amount of memory it should take. But it fails in killing it. my log is full of entries like this:
Failed 624 0 1036 11:15 PM Wednesday May 13 2015
Failed 7408 68 65 12:36 AM Thursday May 14 2015
Failed 7408 92 121 12:37 AM Thursday May 14 2015
Failed 7408 80 142 12:39 AM Thursday May 14 2015
Failed 7408 55 176 12:39 AM Thursday May 14 2015
Failed 7408 99 149 12:46 AM Thursday May 14 2015
Failed 7408 80 150 12:53 AM Thursday May 14 2015
Can someone help me in this?
Should I use run + taskkill instead?
Or is there a WMI command I can use?
Thanks.

Answer 1

Killing svchost.exe (service host process) is probably a bad idea. An instance of svchost usually takes care of multiple services and if you kill it all the services that run under it will stop.
You should rather try to find out which service is causing the system to become unstable, then find out which program this service is part of and then update or uninstall that program... or in the worst case stop the service.
You could also disable the service to keep it from starting automatically when windows does.
I recommend the process explorer from sysinternals. Just hover over an svchost process and a tooltip will show you which services it currently hosts.
To disable or stop a service go here: Win+R -> services.msc -> Enter