Re: problem connecting windows update - CPU 100% svchost.exe

[MoosieAZ]

Re: problem connecting windows update - CPU 100% svchost.exe

Unfortunately this problem (or one identical) has returned, almost exactly 1
year after these posts began. On May 7th I had been using my stable Windows
XP/SP2 desktop system as usual, until exactly 10AM, at which time the system
became unresponsive. Eventually I was able to get into Task Manager and
found SVCHOST at 99% CPU. Several reboots later, and using Process Explorer
I found that wuaueng.dll was using the CPU. If I suspend that task, the
system frees and everything returns to normal.

I already had the fixes on my system mentioned in this thread. With no new
info available from any source, I decided to just let my system run at 100%.
Several hours later I found that the system was idle, and when I checked logs
and other files I discovered that a windows update cycle had started at 10
AM. I thought I was out of the woods, because after I rebooted everything
seemed okay. At 3 PM another 'update' cycle started again (on its own; my
auto update time is set to 3 AM) and the system went to 100% CPU. I left it
alone again for several hours and when I checked it was fine. That was
several days ago, and no recurrence since then. However, a friend asked for
my help yesterday with his laptop - same issue, which I'm now trying to
correct.

This stinks Microsoft!


"Ottmar Freudenberger" wrote:

> "Rollo" <Rollo@discussions.microsoft.com> schrieb:
>
> > everythime I try to connect to winduws update, no list of item can be
> > displayed. The browser stays in "hang status", the svchost process arrives to
> > 100% CPU until it blocks everything. No error reported.
>
> If you want to have it resolved now (and not wait another ~4 weeks):
> Download and install KB927891 (v2) links to be found for your Windows
> version in http://support.microsoft.com/kb/927891
>
> After you've installed that one, download an install the actual version
> of Windows Update Agent 3.0 via
> http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe
>
> I'm assuming you're *not* running Windows Vista and no 64bit version
> of any Windows.
>
> Bye,
> Freudi
>

 

[Chuck]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core
ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
other incidents described in this article, most notably that of MoosieAZ. I
traced the problem to an instance of the svchost.exe process and am dismayed
to report that it finally retired into the background after 47 minutes of CPU
time. Further, it executed several hundred BILLION I/O Read Bytes. Yep,
MINUTES and BILLIONS. I can't possibly imagine what operation could consume
such resources and still run to apparent completion. Seems like a process
that asks "Are these few/dozen/hundreds DLLs up to date?" should be able to
answer that question in a mere fraction of the time . . . and resources.

This behavior repeated itself everytime she restarted the laptop. (This
occurs frequently, since her habit is to turn off the machine when she's
done with any usage session. I realize some pain could be avoided by leaving
the laptop running, but that's not the point.) After several 47 minute
cycles on subsequent start-ups, the computer seemed to have been happy with
the work it performed and, per the System Event Log, indicated that about a
dozen Office 2003 updates were SCHEDULED for installation at 3:00 a.m. on
5/10/2008. Most of the updates seemed to be security related.

We left the laptop on over night so it could plow through the 3:00 a.m.
installation, which logs indicate it accomplished successfully, though I have
no CPU or I/O stats to report.

I thought we were clear of the problem, but the same 100% CPU behavior began
again this morning (Sunday, 5/11/2008). Armed with a little more knowledge
of the potential culprit, I was able to confirm that a svchost.exe instance
was indeed racking up the CPU and I/O, the former of which rivaled the System
Idle Process. From Process Explorer (procexp.exe) I confirmed that
'wuauserv' was a member of the svchost instance and was able to successfully
kill 'wuauserv'. The system recovered in a matter of seconds and the
computer returned to its normal responsiveness.

I can confirm that KB 927891 was delivered on 5/23/2007, not too long after
the initial post on this thread and presumably as a result of Windows Update
performing properly. I'm not certain whether it was successfully installed,
though. The KB927891.log file indicates fourteen files were copied, but the
log also contains twenty consecutive lines of "KB927891 encountered an error:
The update.ver file is not correct." near the beginning and scattered other
"failure" messages throughout.

Regarding any updating of Windows Update Agent to 3.0, I can only report the
dates and internal versions of the following "wuau..." files in
C:\Windows\System32:

wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
(winmain(wmbla).070730-1740)
wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
lab01_n(wmbla)
wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
(winmain(wmbla).070730-1740)
wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
lab01_n(wmbla)
wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
(xpsp_sp2_rtm.040803-2158)

I present this information in as much detail as I can muster because it
seems our symptoms align well with described problem, but it disturbs me that
most of the posts on this thread date back to May 2007. I would have
expected that Microsoft would have resolved the problem in less that twelve
months. The laptop has been on Automatic Updates since shortly after we
received it, although I only installed Office 2003 on it a few weeks ago.

I am reluctant to proceed with the (re?)installation of KB 927891 and update
to Windows Update Agent 3.0 described earlier because it seems like it is old
guidance. How do we get this problem resolved?

 

[PA Bear [MS MVP]]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Try this:

1. Start | Run | (type in) CMD | [OK]

2. In the Command box, carefully type the following, hitting ENTER after
typing each line:

• net stop wuauserv [ENTER]

• rmdir c:\windows\softwaredistribution /s [ENTER]

• net start wuauserv [ENTER]

3. Close the Command window and Reboot.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/


Chuck wrote:
> Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core
> ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
> other incidents described in this article, most notably that of MoosieAZ.
> I
> traced the problem to an instance of the svchost.exe process and am
> dismayed
> to report that it finally retired into the background after 47 minutes of
> CPU time. Further, it executed several hundred BILLION I/O Read Bytes.
> Yep, MINUTES and BILLIONS. I can't possibly imagine what operation could
> consume such resources and still run to apparent completion. Seems like a
> process that asks "Are these few/dozen/hundreds DLLs up to date?" should
> be
> able to answer that question in a mere fraction of the time . . . and
> resources.
>
> This behavior repeated itself everytime she restarted the laptop. (This
> occurs frequently, since her habit is to turn off the machine when she's
> done with any usage session. I realize some pain could be avoided by
> leaving the laptop running, but that's not the point.) After several 47
> minute cycles on subsequent start-ups, the computer seemed to have been
> happy with the work it performed and, per the System Event Log, indicated
> that about a dozen Office 2003 updates were SCHEDULED for installation at
> 3:00 a.m. on 5/10/2008. Most of the updates seemed to be security
> related.
>
> We left the laptop on over night so it could plow through the 3:00 a.m.
> installation, which logs indicate it accomplished successfully, though I
> have no CPU or I/O stats to report.
>
> I thought we were clear of the problem, but the same 100% CPU behavior
> began
> again this morning (Sunday, 5/11/2008). Armed with a little more
> knowledge
> of the potential culprit, I was able to confirm that a svchost.exe
> instance
> was indeed racking up the CPU and I/O, the former of which rivaled the
> System Idle Process. From Process Explorer (procexp.exe) I confirmed that
> 'wuauserv' was a member of the svchost instance and was able to
> successfully
> kill 'wuauserv'. The system recovered in a matter of seconds and the
> computer returned to its normal responsiveness.
>
> I can confirm that KB 927891 was delivered on 5/23/2007, not too long
> after
> the initial post on this thread and presumably as a result of Windows
> Update
> performing properly. I'm not certain whether it was successfully
> installed,
> though. The KB927891.log file indicates fourteen files were copied, but
> the
> log also contains twenty consecutive lines of "KB927891 encountered an
> error: The update.ver file is not correct." near the beginning and
> scattered other "failure" messages throughout.
>
> Regarding any updating of Windows Update Agent to 3.0, I can only report
> the
> dates and internal versions of the following "wuau..." files in
> C:\Windows\System32:
>
> wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
> (xpsp_sp2_rtm.040803-2158)
>
> I present this information in as much detail as I can muster because it
> seems our symptoms align well with described problem, but it disturbs me
> that most of the posts on this thread date back to May 2007. I would have
> expected that Microsoft would have resolved the problem in less that
> twelve
> months. The laptop has been on Automatic Updates since shortly after we
> received it, although I only installed Office 2003 on it a few weeks ago.
>
> I am reluctant to proceed with the (re?)installation of KB 927891 and
> update
> to Windows Update Agent 3.0 described earlier because it seems like it is
> old guidance. How do we get this problem resolved?

 

[Harry Johnston [MVP]]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

MoosieAZ wrote:

> Unfortunately this problem (or one identical) has returned, almost exactly 1
> year after these posts began. On May 7th I had been using my stable Windows
> XP/SP2 desktop system as usual, until exactly 10AM, at which time the system
> became unresponsive. Eventually I was able to get into Task Manager and
> found SVCHOST at 99% CPU. Several reboots later, and using Process Explorer
> I found that wuaueng.dll was using the CPU. If I suspend that task, the
> system frees and everything returns to normal.

This may be applicable:

<http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3241867&SiteID=17>

The problem seems to be caused by CA antivirus.

Harry.

 

[jkloosterman]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Have a look at this discussion and especially the contribution from Colflagg.
The problem that Colflagg discribes has nothing to do Microsoft but with CA
Antivirus.
http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3323151&SiteID=17
Are you running CA AV? If so, than at least you know where your problem is.

"Chuck" wrote:

> Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core
> ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
> other incidents described in this article, most notably that of MoosieAZ. I
> traced the problem to an instance of the svchost.exe process and am dismayed
> to report that it finally retired into the background after 47 minutes of CPU
> time. Further, it executed several hundred BILLION I/O Read Bytes. Yep,
> MINUTES and BILLIONS. I can't possibly imagine what operation could consume
> such resources and still run to apparent completion. Seems like a process
> that asks "Are these few/dozen/hundreds DLLs up to date?" should be able to
> answer that question in a mere fraction of the time . . . and resources.
>
> This behavior repeated itself everytime she restarted the laptop. (This
> occurs frequently, since her habit is to turn off the machine when she's
> done with any usage session. I realize some pain could be avoided by leaving
> the laptop running, but that's not the point.) After several 47 minute
> cycles on subsequent start-ups, the computer seemed to have been happy with
> the work it performed and, per the System Event Log, indicated that about a
> dozen Office 2003 updates were SCHEDULED for installation at 3:00 a.m. on
> 5/10/2008. Most of the updates seemed to be security related.
>
> We left the laptop on over night so it could plow through the 3:00 a.m.
> installation, which logs indicate it accomplished successfully, though I have
> no CPU or I/O stats to report.
>
> I thought we were clear of the problem, but the same 100% CPU behavior began
> again this morning (Sunday, 5/11/2008). Armed with a little more knowledge
> of the potential culprit, I was able to confirm that a svchost.exe instance
> was indeed racking up the CPU and I/O, the former of which rivaled the System
> Idle Process. From Process Explorer (procexp.exe) I confirmed that
> 'wuauserv' was a member of the svchost instance and was able to successfully
> kill 'wuauserv'. The system recovered in a matter of seconds and the
> computer returned to its normal responsiveness.
>
> I can confirm that KB 927891 was delivered on 5/23/2007, not too long after
> the initial post on this thread and presumably as a result of Windows Update
> performing properly. I'm not certain whether it was successfully installed,
> though. The KB927891.log file indicates fourteen files were copied, but the
> log also contains twenty consecutive lines of "KB927891 encountered an error:
> The update.ver file is not correct." near the beginning and scattered other
> "failure" messages throughout.
>
> Regarding any updating of Windows Update Agent to 3.0, I can only report the
> dates and internal versions of the following "wuau..." files in
> C:\Windows\System32:
>
> wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
> (xpsp_sp2_rtm.040803-2158)
>
> I present this information in as much detail as I can muster because it
> seems our symptoms align well with described problem, but it disturbs me that
> most of the posts on this thread date back to May 2007. I would have
> expected that Microsoft would have resolved the problem in less that twelve
> months. The laptop has been on Automatic Updates since shortly after we
> received it, although I only installed Office 2003 on it a few weeks ago.
>
> I am reluctant to proceed with the (re?)installation of KB 927891 and update
> to Windows Update Agent 3.0 described earlier because it seems like it is old
> guidance. How do we get this problem resolved?

 

[shayward]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

This is happening to me as well - and it just started in the middle of last
week. Automatic Updates is the offender - I disabled it in MSCONFIG and all
is well (other than the fact that Automatic Updates is disabled).

SVCHOST consumes 100% CPU and it starts eating memory until it reaches >
100MB.

 

[PA Bear [MS MVP]]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Harry Johnston [MVP] wrote:
> MoosieAZ wrote:
>> Unfortunately this problem (or one identical) has returned, almost
>> exactly
>> 1 year after these posts began. On May 7th I had been using my stable
>> Windows XP/SP2 desktop system as usual, until exactly 10AM, at which time
>> the system became unresponsive. Eventually I was able to get into Task
>> Manager and found SVCHOST at 99% CPU. Several reboots later, and using
>> Process Explorer I found that wuaueng.dll was using the CPU. If I
>> suspend
>> that task, the system frees and everything returns to normal.
>
> This may be applicable:
>
> <http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3241867&SiteID=17>
>
> The problem seems to be caused by CA antivirus.

Nice catch, Harry!

From the thread cited above:

<QP>
Have just got off talking to a CA technician. Was advised to exclude all
*.msp and *.msi files in the Real-Time scan.

What I did was:

1. "Open Security Center"
2. "Open Advance Settings"
3. Clicked on the "Options" button
4. Clicked on the "Modify" link under the Exclusions list and then "Added"
*.msi and *.msp to the list and clicked OK
</QP>
--
~Robear

CC: Mow; Kaylene; Bitz; Jesper

 

[MoosieAZ]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Chuck, the problem I had with the 2nd machine (Dell laptop) did not get
resolved as easily as the situation I described earlier. This time it seems
to
resemble the situation you describe. I did finally get it fixed after many
hours
of searching and trying different approaches. Here is what I did:

1) First I tried to let it run itself to health, which it did, but only
until the next
boot and then it started all over again.

2) After it had cleared up on its own I decided to force a Windows Update
cycle to see if that would trigger the problem again; it did, but I let it
run. I
didn't time it because I was doing other chores around the house, but about 2
hours later I checked and the screen indicated that some update
[unidentified]
had been applied AND there was a message on the screen inviting me to
download and install SP3.

3) Since I had nothing to loose I did select to download and install SP3 (I
snoozed my CA Antivirus program, as several people reported difficulties with
SP3 conflicting with A/V and antispyware programs). To my amazement, it
seemed to work. When I checked on the progress a while later, it was waiting
at a screen which told me to restart the machine. I did so, but after the
reboot, the same damn problem with 100% CPU was still with me.

4) I spent another hour or so checking different forums and noted a growing
number of posts relating to this issue. Some suggested that Microsoft was
attempting to screen millions of PCs before forcing out the SP3 update via
automatic update; I know that sounds like malcontents spinning a conspiracy
theory, but it did make some sense. Clearly Microsoft did something via the
update process to trigger the problem on my machine (and the laptop) - it had
been running just fine until Wednesday morning. I looked at so many forums
and posts that I can't say with certainty, but I believe I finally found
something
that worked on the dslreports.com site. One poster said they had done many
of the things I had already done, but they decided to delete the
SoftwareDistribution folder in the Windows directory, and would post back
later to provide an update.

5) Although I was cautious, I decided to try that on the problematic laptop.
I
stopped the windows update service (to release the folder), then I just
renamed C:\Windows\SoftwareDistribution to
C:\Windows\SoftwareDistributionX and then I rebooted the machine. For the
first time in days it started normally, AND it seemed to be running quicker
than
it had originally. Perhaps SP3 does make a difference. I checked the
Windows directory and found a brand new SoftwareDistribution folder in
addition to the original I had renamed. Anyway, since it seemed to be
running
normally I decided to take a chance and run a Windows Update; it ran and
found a few non-critical updates so I allowed it to download/install them.
That
too worked normally so I ran it once more and it now found a critical update
for Windows Media Player 11, which had been installed in the previous run.
It
installed the update and the system seemed to be fine. I rebooted once more
to make sure, and sure enough, everything appeared normal.

That was a long story, but not nearly as long as the hours spent on finding a
resolution between Friday and late Sunday evening. My overall conclusion is
that this was no freak accident. Someone within Microsoft approved some
process to go out via Windows Update [true reasons unknown] and that
decision had unintended consequences for many people. Will Microsoft [if
they monitor these posts] step up and come clean? Probably not, but it would
sure as hell be refreshing.

Good luck.


"Chuck" wrote:

> Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core
> ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
> other incidents described in this article, most notably that of MoosieAZ. I
> traced the problem to an instance of the svchost.exe process and am dismayed
> to report that it finally retired into the background after 47 minutes of CPU
> time. Further, it executed several hundred BILLION I/O Read Bytes. Yep,
> MINUTES and BILLIONS. I can't possibly imagine what operation could consume
> such resources and still run to apparent completion. Seems like a process
> that asks "Are these few/dozen/hundreds DLLs up to date?" should be able to
> answer that question in a mere fraction of the time . . . and resources.
>
> This behavior repeated itself everytime she restarted the laptop. (This
> occurs frequently, since her habit is to turn off the machine when she's
> done with any usage session. I realize some pain could be avoided by leaving
> the laptop running, but that's not the point.) After several 47 minute
> cycles on subsequent start-ups, the computer seemed to have been happy with
> the work it performed and, per the System Event Log, indicated that about a
> dozen Office 2003 updates were SCHEDULED for installation at 3:00 a.m. on
> 5/10/2008. Most of the updates seemed to be security related.
>
> We left the laptop on over night so it could plow through the 3:00 a.m.
> installation, which logs indicate it accomplished successfully, though I have
> no CPU or I/O stats to report.
>
> I thought we were clear of the problem, but the same 100% CPU behavior began
> again this morning (Sunday, 5/11/2008). Armed with a little more knowledge
> of the potential culprit, I was able to confirm that a svchost.exe instance
> was indeed racking up the CPU and I/O, the former of which rivaled the System
> Idle Process. From Process Explorer (procexp.exe) I confirmed that
> 'wuauserv' was a member of the svchost instance and was able to successfully
> kill 'wuauserv'. The system recovered in a matter of seconds and the
> computer returned to its normal responsiveness.
>
> I can confirm that KB 927891 was delivered on 5/23/2007, not too long after
> the initial post on this thread and presumably as a result of Windows Update
> performing properly. I'm not certain whether it was successfully installed,
> though. The KB927891.log file indicates fourteen files were copied, but the
> log also contains twenty consecutive lines of "KB927891 encountered an error:
> The update.ver file is not correct." near the beginning and scattered other
> "failure" messages throughout.
>
> Regarding any updating of Windows Update Agent to 3.0, I can only report the
> dates and internal versions of the following "wuau..." files in
> C:\Windows\System32:
>
> wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
> (xpsp_sp2_rtm.040803-2158)
>
> I present this information in as much detail as I can muster because it
> seems our symptoms align well with described problem, but it disturbs me that
> most of the posts on this thread date back to May 2007. I would have
> expected that Microsoft would have resolved the problem in less that twelve
> months. The laptop has been on Automatic Updates since shortly after we
> received it, although I only installed Office 2003 on it a few weeks ago.
>
> I am reluctant to proceed with the (re?)installation of KB 927891 and update
> to Windows Update Agent 3.0 described earlier because it seems like it is old
> guidance. How do we get this problem resolved?

 

[Derek Richards]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Did the exclusions in CA make any difference? Didn't make a scrap of
difference to me.

"PA Bear [MS MVP]" wrote:

> Harry Johnston [MVP] wrote:
> > MoosieAZ wrote:
> >> Unfortunately this problem (or one identical) has returned, almost
> >> exactly
> >> 1 year after these posts began. On May 7th I had been using my stable
> >> Windows XP/SP2 desktop system as usual, until exactly 10AM, at which time
> >> the system became unresponsive. Eventually I was able to get into Task
> >> Manager and found SVCHOST at 99% CPU. Several reboots later, and using
> >> Process Explorer I found that wuaueng.dll was using the CPU. If I
> >> suspend
> >> that task, the system frees and everything returns to normal.
> >
> > This may be applicable:
> >
> > <http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3241867&SiteID=17>
> >
> > The problem seems to be caused by CA antivirus.
>
> Nice catch, Harry!
>
> From the thread cited above:
>
> <QP>
> Have just got off talking to a CA technician. Was advised to exclude all
> *.msp and *.msi files in the Real-Time scan.
>
> What I did was:
>
> 1. "Open Security Center"
> 2. "Open Advance Settings"
> 3. Clicked on the "Options" button
> 4. Clicked on the "Modify" link under the Exclusions list and then "Added"
> *.msi and *.msp to the list and clicked OK
> </QP>
> --
> ~Robear
>
> CC: Mow; Kaylene; Bitz; Jesper
>
>

 

[PA Bear [MS MVP]]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Maybe you should begin your own thread?

Derek Richards wrote:
> Did the exclusions in CA make any difference? Didn't make a scrap of
> difference to me...

 

[Derek Richards]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Why's that? It's exactly the same problem, but excluding the files from the
realtime scanner didn't do the trick (just as other potential fixes haven't
worked for other people.

"PA Bear [MS MVP]" wrote:

> Maybe you should begin your own thread?
>
> Derek Richards wrote:
> > Did the exclusions in CA make any difference? Didn't make a scrap of
> > difference to me...
>

 

[Helenix]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

This seems to have worked so far - thank you

Has the underlying problem been identified and resolved yet?



"PA Bear [MS MVP]" wrote:

> Try this:
>
> 1. Start | Run | (type in) CMD | [OK]
>
> 2. In the Command box, carefully type the following, hitting ENTER after
> typing each line:
>
> • net stop wuauserv [ENTER]
>
> • rmdir c:\windows\softwaredistribution /s [ENTER]
>
> • net start wuauserv [ENTER]
>
> 3. Close the Command window and Reboot.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
>
> Chuck wrote:
> > Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core
> > ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
> > other incidents described in this article, most notably that of MoosieAZ.
> > I
> > traced the problem to an instance of the svchost.exe process and am
> > dismayed
> > to report that it finally retired into the background after 47 minutes of
> > CPU time. Further, it executed several hundred BILLION I/O Read Bytes.
> > Yep, MINUTES and BILLIONS. I can't possibly imagine what operation could
> > consume such resources and still run to apparent completion. Seems like a
> > process that asks "Are these few/dozen/hundreds DLLs up to date?" should
> > be
> > able to answer that question in a mere fraction of the time . . . and
> > resources.
> >
> > This behavior repeated itself everytime she restarted the laptop. (This
> > occurs frequently, since her habit is to turn off the machine when she's
> > done with any usage session. I realize some pain could be avoided by
> > leaving the laptop running, but that's not the point.) After several 47
> > minute cycles on subsequent start-ups, the computer seemed to have been
> > happy with the work it performed and, per the System Event Log, indicated
> > that about a dozen Office 2003 updates were SCHEDULED for installation at
> > 3:00 a.m. on 5/10/2008. Most of the updates seemed to be security
> > related.
> >
> > We left the laptop on over night so it could plow through the 3:00 a.m.
> > installation, which logs indicate it accomplished successfully, though I
> > have no CPU or I/O stats to report.
> >
> > I thought we were clear of the problem, but the same 100% CPU behavior
> > began
> > again this morning (Sunday, 5/11/2008). Armed with a little more
> > knowledge
> > of the potential culprit, I was able to confirm that a svchost.exe
> > instance
> > was indeed racking up the CPU and I/O, the former of which rivaled the
> > System Idle Process. From Process Explorer (procexp.exe) I confirmed that
> > 'wuauserv' was a member of the svchost instance and was able to
> > successfully
> > kill 'wuauserv'. The system recovered in a matter of seconds and the
> > computer returned to its normal responsiveness.
> >
> > I can confirm that KB 927891 was delivered on 5/23/2007, not too long
> > after
> > the initial post on this thread and presumably as a result of Windows
> > Update
> > performing properly. I'm not certain whether it was successfully
> > installed,
> > though. The KB927891.log file indicates fourteen files were copied, but
> > the
> > log also contains twenty consecutive lines of "KB927891 encountered an
> > error: The update.ver file is not correct." near the beginning and
> > scattered other "failure" messages throughout.
> >
> > Regarding any updating of Windows Update Agent to 3.0, I can only report
> > the
> > dates and internal versions of the following "wuau..." files in
> > C:\Windows\System32:
> >
> > wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
> > (winmain(wmbla).070730-1740)
> > wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
> > lab01_n(wmbla)
> > wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
> > (winmain(wmbla).070730-1740)
> > wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
> > lab01_n(wmbla)
> > wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
> > (xpsp_sp2_rtm.040803-2158)
> >
> > I present this information in as much detail as I can muster because it
> > seems our symptoms align well with described problem, but it disturbs me
> > that most of the posts on this thread date back to May 2007. I would have
> > expected that Microsoft would have resolved the problem in less that
> > twelve
> > months. The laptop has been on Automatic Updates since shortly after we
> > received it, although I only installed Office 2003 on it a few weeks ago.
> >
> > I am reluctant to proceed with the (re?)installation of KB 927891 and
> > update
> > to Windows Update Agent 3.0 described earlier because it seems like it is
> > old guidance. How do we get this problem resolved?
>
>

 

[Harry Johnston [MVP]]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

PA Bear [MS MVP] wrote:

> <QP>
> Have just got off talking to a CA technician. Was advised to exclude
> all *.msp and *.msi files in the Real-Time scan. [...]
> </QP>

Of course, those are file types that definitely should be scanned. :-(

It may be more effective to uninstall CA altogether (for non-commercial use,
Avast is a free alternative that I've been very happy with - although I haven't
installed SP3 on my home machine yet) or to disable automatic updates until CA
release a proper fix.

Harry.

 

[Derek Richards]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

Are you running CA AV? If so try excluding the files mentioned in previous
posts and also stop the automatic updates service, then rename the
windows\softwaredistibution folder to softwaredistibution.old, restart
automatic updates service. This seems to be working for me so far. I had also
applied the suggested patches without any luck.

"shayward" wrote:

> This is happening to me as well - and it just started in the middle of last
> week. Automatic Updates is the offender - I disabled it in MSCONFIG and all
> is well (other than the fact that Automatic Updates is disabled).
>
> SVCHOST consumes 100% CPU and it starts eating memory until it reaches >
> 100MB.

 

[Martin C]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

I had the same problem with CA Antivirus. They are aware of the problem and
working on a fix. Not sure how long that will be though. Rather than disable
real time scanning - as this is as good as not having a scanner in the first
place - exclude the *.msi and *.msp files. This worked for me.

Martin


"Derek Richards" <DerekRichards@discussions.microsoft.com> wrote in message
news:B1F2EE31-5D26-4B4B-ADBB-9420394B9D36@microsoft.com...
> Are you running CA AV? If so try excluding the files mentioned in previous
> posts and also stop the automatic updates service, then rename the
> windows\softwaredistibution folder to softwaredistibution.old, restart
> automatic updates service. This seems to be working for me so far. I had
> also
> applied the suggested patches without any luck.
>
> "shayward" wrote:
>
>> This is happening to me as well - and it just started in the middle of
>> last
>> week. Automatic Updates is the offender - I disabled it in MSCONFIG and
>> all
>> is well (other than the fact that Automatic Updates is disabled).
>>
>> SVCHOST consumes 100% CPU and it starts eating memory until it reaches >
>> 100MB.

 

[Derek Richards]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

I have now successfully fixed this on 3 PCs with CA without excluding any
files.
Start, run, CMD.
net stop wuauserv
then in my computer rename windows\softwaredistibution folder to
softwaredistribution.old
go back to cmd prompt
net start wuauserv


"Martin C" wrote:

> I had the same problem with CA Antivirus. They are aware of the problem and
> working on a fix. Not sure how long that will be though. Rather than disable
> real time scanning - as this is as good as not having a scanner in the first
> place - exclude the *.msi and *.msp files. This worked for me.
>
> Martin
>
>
> "Derek Richards" <DerekRichards@discussions.microsoft.com> wrote in message
> news:B1F2EE31-5D26-4B4B-ADBB-9420394B9D36@microsoft.com...
> > Are you running CA AV? If so try excluding the files mentioned in previous
> > posts and also stop the automatic updates service, then rename the
> > windows\softwaredistibution folder to softwaredistibution.old, restart
> > automatic updates service. This seems to be working for me so far. I had
> > also
> > applied the suggested patches without any luck.
> >
> > "shayward" wrote:
> >
> >> This is happening to me as well - and it just started in the middle of
> >> last
> >> week. Automatic Updates is the offender - I disabled it in MSCONFIG and
> >> all
> >> is well (other than the fact that Automatic Updates is disabled).
> >>
> >> SVCHOST consumes 100% CPU and it starts eating memory until it reaches >
> >> 100MB.
>
>
>

 

[PA Bear [MS MVP]]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

QED: Why was this step necessary?

Derek Richards wrote:
> I have now successfully fixed this on 3 PCs with CA without excluding any
> files.
> Start, run, CMD.
> net stop wuauserv
> then in my computer rename windows\softwaredistibution folder to
> softwaredistribution.old
> go back to cmd prompt
> net start wuauserv
>
>
> "Martin C" wrote:
>
>> I had the same problem with CA Antivirus. They are aware of the problem
>> and
>> working on a fix. Not sure how long that will be though. Rather than
>> disable real time scanning - as this is as good as not having a scanner
>> in
>> the first place - exclude the *.msi and *.msp files. This worked for me.
>>
>> Martin
>>
>>
>> "Derek Richards" <DerekRichards@discussions.microsoft.com> wrote in
>> message
>> news:B1F2EE31-5D26-4B4B-ADBB-9420394B9D36@microsoft.com...
>>> Are you running CA AV? If so try excluding the files mentioned in
>>> previous
>>> posts and also stop the automatic updates service, then rename the
>>> windows\softwaredistibution folder to softwaredistibution.old, restart
>>> automatic updates service. This seems to be working for me so far. I had
>>> also
>>> applied the suggested patches without any luck.
>>>
>>> "shayward" wrote:
>>>
>>>> This is happening to me as well - and it just started in the middle of
>>>> last
>>>> week. Automatic Updates is the offender - I disabled it in MSCONFIG and
>>>> all
>>>> is well (other than the fact that Automatic Updates is disabled).
>>>>
>>>> SVCHOST consumes 100% CPU and it starts eating memory until it reaches
>>>> >
>>>> 100MB.

 

[Derek Richards]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

I'm not sure why it was necessary but it does seem to eliminate CA. It was
originally your idea to remove the softwaredistribution folder - I just
renamed it instead. The point is, it works with no change to CA AV.

"PA Bear [MS MVP]" wrote:

> QED: Why was this step necessary?
>
> Derek Richards wrote:
> > I have now successfully fixed this on 3 PCs with CA without excluding any
> > files.
> > Start, run, CMD.
> > net stop wuauserv
> > then in my computer rename windows\softwaredistibution folder to
> > softwaredistribution.old
> > go back to cmd prompt
> > net start wuauserv
> >
> >
> > "Martin C" wrote:
> >
> >> I had the same problem with CA Antivirus. They are aware of the problem
> >> and
> >> working on a fix. Not sure how long that will be though. Rather than
> >> disable real time scanning - as this is as good as not having a scanner
> >> in
> >> the first place - exclude the *.msi and *.msp files. This worked for me.
> >>
> >> Martin
> >>
> >>
> >> "Derek Richards" <DerekRichards@discussions.microsoft.com> wrote in
> >> message
> >> news:B1F2EE31-5D26-4B4B-ADBB-9420394B9D36@microsoft.com...
> >>> Are you running CA AV? If so try excluding the files mentioned in
> >>> previous
> >>> posts and also stop the automatic updates service, then rename the
> >>> windows\softwaredistibution folder to softwaredistibution.old, restart
> >>> automatic updates service. This seems to be working for me so far. I had
> >>> also
> >>> applied the suggested patches without any luck.
> >>>
> >>> "shayward" wrote:
> >>>
> >>>> This is happening to me as well - and it just started in the middle of
> >>>> last
> >>>> week. Automatic Updates is the offender - I disabled it in MSCONFIG and
> >>>> all
> >>>> is well (other than the fact that Automatic Updates is disabled).
> >>>>
> >>>> SVCHOST consumes 100% CPU and it starts eating memory until it reaches
> >>>> >
> >>>> 100MB.
>
>

 

[DZTN]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

My institution also began to see this issue on all machines starting around
5/8/2008. Please share information that relates to this rescent problem.
Thanks

"Chuck" wrote:

> Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core
> ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
> other incidents described in this article, most notably that of MoosieAZ. I
> traced the problem to an instance of the svchost.exe process and am dismayed
> to report that it finally retired into the background after 47 minutes of CPU
> time. Further, it executed several hundred BILLION I/O Read Bytes. Yep,
> MINUTES and BILLIONS. I can't possibly imagine what operation could consume
> such resources and still run to apparent completion. Seems like a process
> that asks "Are these few/dozen/hundreds DLLs up to date?" should be able to
> answer that question in a mere fraction of the time . . . and resources.
>
> This behavior repeated itself everytime she restarted the laptop. (This
> occurs frequently, since her habit is to turn off the machine when she's
> done with any usage session. I realize some pain could be avoided by leaving
> the laptop running, but that's not the point.) After several 47 minute
> cycles on subsequent start-ups, the computer seemed to have been happy with
> the work it performed and, per the System Event Log, indicated that about a
> dozen Office 2003 updates were SCHEDULED for installation at 3:00 a.m. on
> 5/10/2008. Most of the updates seemed to be security related.
>
> We left the laptop on over night so it could plow through the 3:00 a.m.
> installation, which logs indicate it accomplished successfully, though I have
> no CPU or I/O stats to report.
>
> I thought we were clear of the problem, but the same 100% CPU behavior began
> again this morning (Sunday, 5/11/2008). Armed with a little more knowledge
> of the potential culprit, I was able to confirm that a svchost.exe instance
> was indeed racking up the CPU and I/O, the former of which rivaled the System
> Idle Process. From Process Explorer (procexp.exe) I confirmed that
> 'wuauserv' was a member of the svchost instance and was able to successfully
> kill 'wuauserv'. The system recovered in a matter of seconds and the
> computer returned to its normal responsiveness.
>
> I can confirm that KB 927891 was delivered on 5/23/2007, not too long after
> the initial post on this thread and presumably as a result of Windows Update
> performing properly. I'm not certain whether it was successfully installed,
> though. The KB927891.log file indicates fourteen files were copied, but the
> log also contains twenty consecutive lines of "KB927891 encountered an error:
> The update.ver file is not correct." near the beginning and scattered other
> "failure" messages throughout.
>
> Regarding any updating of Windows Update Agent to 3.0, I can only report the
> dates and internal versions of the following "wuau..." files in
> C:\Windows\System32:
>
> wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
> (xpsp_sp2_rtm.040803-2158)
>
> I present this information in as much detail as I can muster because it
> seems our symptoms align well with described problem, but it disturbs me that
> most of the posts on this thread date back to May 2007. I would have
> expected that Microsoft would have resolved the problem in less that twelve
> months. The laptop has been on Automatic Updates since shortly after we
> received it, although I only installed Office 2003 on it a few weeks ago.
>
> I am reluctant to proceed with the (re?)installation of KB 927891 and update
> to Windows Update Agent 3.0 described earlier because it seems like it is old
> guidance. How do we get this problem resolved?

 

[Harry Johnston [MVP]]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

DZTN wrote:

> My institution also began to see this issue on all machines starting around
> 5/8/2008. Please share information that relates to this rescent problem.

Are your machines cloned?

Do you run CA antivirus?

Have you tried deleting the softwaredistribution folder on one of the affected
machines?

Harry.