Re: problem connecting windows update - CPU 100% svchost.exe

[Antony Scerri]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

I think im in the same boat here with a laptop which after an update on 19th
May (WAU had been disabled since april time so hadnt run or been used) is now
going 100% CPU usage during update scans.

Its tied to another issue my machine is now experiencing, which happened on
my last laptop after it too hit the 100% CPU during the update process when
the problem first arose prior to Update agent 3.0 being released around a
year ago. Both machines now keep hitting the disk every second even when
nothing is running and im not using the machine, with periods of the machines
fans kicking in even when Task Manager shows no apparent CPU usage. Any small
spike in CPU usage also causes the fan to kick in where it used to wait a
while unless it was 100% usage for a shorter period would cause it to kick
in. For anyone interested my other post is -
http://www.microsoft.com/windowsxp/...&p=1&tid=4988131c-a0db-46c5-a8ff-c433a4da9383

So im interested in any conclusions people come to.

Tony

 

[MoosieAZ]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

From posts in various groups across the net, and from personal experience, I
think this problem has run it's course. It appears that starting on May 7th
(give or take a day) the contents of the C:\Windows\SoftwareDistribution
folder, the Windows Update service, and the CA AntiVirus real-time scanner
(engine 31.4) collided.

Excluding installer file types from A/V scans, or snoozing the A/V, or
deleting/renaming the C:\Windows\SoftwareDistribution, OR a combination of
these tricks did seem to resolve the issue. Then about a week after it all
began, CA released engine 31.5 via their automatic update and life has
returned back to whatever the hell is normal.

P.S. Make sure you remove any exclusions for CA A/V that you may have
implemented as a circumvention.
--
"An age is called Dark, not because the light fails to shine, but because
people refuse to see it." - James A. Michener


"Derek Richards" wrote:

> I'm not sure why it was necessary but it does seem to eliminate CA. It was
> originally your idea to remove the softwaredistribution folder - I just
> renamed it instead. The point is, it works with no change to CA AV.
>
> "PA Bear [MS MVP]" wrote:
>
> > QED: Why was this step necessary?
> >
> > Derek Richards wrote:
> > > I have now successfully fixed this on 3 PCs with CA without excluding any
> > > files.
> > > Start, run, CMD.
> > > net stop wuauserv
> > > then in my computer rename windows\softwaredistibution folder to
> > > softwaredistribution.old
> > > go back to cmd prompt
> > > net start wuauserv
> > >
> > >
> > > "Martin C" wrote:
> > >
> > >> I had the same problem with CA Antivirus. They are aware of the problem
> > >> and
> > >> working on a fix. Not sure how long that will be though. Rather than
> > >> disable real time scanning - as this is as good as not having a scanner
> > >> in
> > >> the first place - exclude the *.msi and *.msp files. This worked for me.
> > >>
> > >> Martin
> > >>
> > >>
> > >> "Derek Richards" <DerekRichards@discussions.microsoft.com> wrote in
> > >> message
> > >> news:B1F2EE31-5D26-4B4B-ADBB-9420394B9D36@microsoft.com...
> > >>> Are you running CA AV? If so try excluding the files mentioned in
> > >>> previous
> > >>> posts and also stop the automatic updates service, then rename the
> > >>> windows\softwaredistibution folder to softwaredistibution.old, restart
> > >>> automatic updates service. This seems to be working for me so far. I had
> > >>> also
> > >>> applied the suggested patches without any luck.
> > >>>
> > >>> "shayward" wrote:
> > >>>
> > >>>> This is happening to me as well - and it just started in the middle of
> > >>>> last
> > >>>> week. Automatic Updates is the offender - I disabled it in MSCONFIG and
> > >>>> all
> > >>>> is well (other than the fact that Automatic Updates is disabled).
> > >>>>
> > >>>> SVCHOST consumes 100% CPU and it starts eating memory until it reaches
> > >>>> >
> > >>>> 100MB.
> >
> >

 

[Martin C]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

I tend to agree. I don't seem to be having any more problems with CA in that
respect any more.

Martin


"MoosieAZ" <MoosieAZ@discussions.microsoft.com> wrote in message
news:1CBAD616-CE10-4759-B472-C5CE4DCCD5A8@microsoft.com...
> From posts in various groups across the net, and from personal experience,
> I
> think this problem has run it's course. It appears that starting on May
> 7th
> (give or take a day) the contents of the C:\Windows\SoftwareDistribution
> folder, the Windows Update service, and the CA AntiVirus real-time scanner
> (engine 31.4) collided.
>
> Excluding installer file types from A/V scans, or snoozing the A/V, or
> deleting/renaming the C:\Windows\SoftwareDistribution, OR a combination of
> these tricks did seem to resolve the issue. Then about a week after it
> all
> began, CA released engine 31.5 via their automatic update and life has
> returned back to whatever the hell is normal.
>
> P.S. Make sure you remove any exclusions for CA A/V that you may have
> implemented as a circumvention.
> --
> "An age is called Dark, not because the light fails to shine, but because
> people refuse to see it." - James A. Michener
>
>
> "Derek Richards" wrote:
>
>> I'm not sure why it was necessary but it does seem to eliminate CA. It
>> was
>> originally your idea to remove the softwaredistribution folder - I just
>> renamed it instead. The point is, it works with no change to CA AV.
>>
>> "PA Bear [MS MVP]" wrote:
>>
>> > QED: Why was this step necessary?
>> >
>> > Derek Richards wrote:
>> > > I have now successfully fixed this on 3 PCs with CA without excluding
>> > > any
>> > > files.
>> > > Start, run, CMD.
>> > > net stop wuauserv
>> > > then in my computer rename windows\softwaredistibution folder to
>> > > softwaredistribution.old
>> > > go back to cmd prompt
>> > > net start wuauserv
>> > >
>> > >
>> > > "Martin C" wrote:
>> > >
>> > >> I had the same problem with CA Antivirus. They are aware of the
>> > >> problem
>> > >> and
>> > >> working on a fix. Not sure how long that will be though. Rather than
>> > >> disable real time scanning - as this is as good as not having a
>> > >> scanner
>> > >> in
>> > >> the first place - exclude the *.msi and *.msp files. This worked for
>> > >> me.
>> > >>
>> > >> Martin
>> > >>
>> > >>
>> > >> "Derek Richards" <DerekRichards@discussions.microsoft.com> wrote in
>> > >> message
>> > >> news:B1F2EE31-5D26-4B4B-ADBB-9420394B9D36@microsoft.com...
>> > >>> Are you running CA AV? If so try excluding the files mentioned in
>> > >>> previous
>> > >>> posts and also stop the automatic updates service, then rename the
>> > >>> windows\softwaredistibution folder to softwaredistibution.old,
>> > >>> restart
>> > >>> automatic updates service. This seems to be working for me so far.
>> > >>> I had
>> > >>> also
>> > >>> applied the suggested patches without any luck.
>> > >>>
>> > >>> "shayward" wrote:
>> > >>>
>> > >>>> This is happening to me as well - and it just started in the
>> > >>>> middle of
>> > >>>> last
>> > >>>> week. Automatic Updates is the offender - I disabled it in
>> > >>>> MSCONFIG and
>> > >>>> all
>> > >>>> is well (other than the fact that Automatic Updates is disabled).
>> > >>>>
>> > >>>> SVCHOST consumes 100% CPU and it starts eating memory until it
>> > >>>> reaches
>> > >>>> >
>> > >>>> 100MB.
>> >
>> >

 

[Denis]

Re: problem connecting windows update - CPU 100% svchost.exe

Re: problem connecting windows update - CPU 100% svchost.exe

I too am having the exact same problem that Chuck is having. Applying the
fixes to my system does not resolve the problem. It bothers me that all the
tips I find on this problem are dated a year ago. Why has this problem come
back? Why is Microsoft unable to fix this issue permanently?

"Chuck" wrote:

> Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core
> ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
> other incidents described in this article, most notably that of MoosieAZ. I
> traced the problem to an instance of the svchost.exe process and am dismayed
> to report that it finally retired into the background after 47 minutes of CPU
> time. Further, it executed several hundred BILLION I/O Read Bytes. Yep,
> MINUTES and BILLIONS. I can't possibly imagine what operation could consume
> such resources and still run to apparent completion. Seems like a process
> that asks "Are these few/dozen/hundreds DLLs up to date?" should be able to
> answer that question in a mere fraction of the time . . . and resources.
>
> This behavior repeated itself everytime she restarted the laptop. (This
> occurs frequently, since her habit is to turn off the machine when she's
> done with any usage session. I realize some pain could be avoided by leaving
> the laptop running, but that's not the point.) After several 47 minute
> cycles on subsequent start-ups, the computer seemed to have been happy with
> the work it performed and, per the System Event Log, indicated that about a
> dozen Office 2003 updates were SCHEDULED for installation at 3:00 a.m. on
> 5/10/2008. Most of the updates seemed to be security related.
>
> We left the laptop on over night so it could plow through the 3:00 a.m.
> installation, which logs indicate it accomplished successfully, though I have
> no CPU or I/O stats to report.
>
> I thought we were clear of the problem, but the same 100% CPU behavior began
> again this morning (Sunday, 5/11/2008). Armed with a little more knowledge
> of the potential culprit, I was able to confirm that a svchost.exe instance
> was indeed racking up the CPU and I/O, the former of which rivaled the System
> Idle Process. From Process Explorer (procexp.exe) I confirmed that
> 'wuauserv' was a member of the svchost instance and was able to successfully
> kill 'wuauserv'. The system recovered in a matter of seconds and the
> computer returned to its normal responsiveness.
>
> I can confirm that KB 927891 was delivered on 5/23/2007, not too long after
> the initial post on this thread and presumably as a result of Windows Update
> performing properly. I'm not certain whether it was successfully installed,
> though. The KB927891.log file indicates fourteen files were copied, but the
> log also contains twenty consecutive lines of "KB927891 encountered an error:
> The update.ver file is not correct." near the beginning and scattered other
> "failure" messages throughout.
>
> Regarding any updating of Windows Update Agent to 3.0, I can only report the
> dates and internal versions of the following "wuau..." files in
> C:\Windows\System32:
>
> wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
> (winmain(wmbla).070730-1740)
> wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
> lab01_n(wmbla)
> wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
> (xpsp_sp2_rtm.040803-2158)
>
> I present this information in as much detail as I can muster because it
> seems our symptoms align well with described problem, but it disturbs me that
> most of the posts on this thread date back to May 2007. I would have
> expected that Microsoft would have resolved the problem in less that twelve
> months. The laptop has been on Automatic Updates since shortly after we
> received it, although I only installed Office 2003 on it a few weeks ago.
>
> I am reluctant to proceed with the (re?)installation of KB 927891 and update
> to Windows Update Agent 3.0 described earlier because it seems like it is old
> guidance. How do we get this problem resolved?