SVCHOST bug still spikes CPU at 100% 6 months before Windows XP support cut-off

Microsoft has been making it clear for several years that it will cut off support for Windows XP on April 8th, 2014. The 12 year old operating system is still being used by a large percentage of PC owners and with just over six months to go before that support termination date is reached, some Windows XP users are still finding bugs.

One such issue was recently reported by Neowin community member "warwagon" in our forums. He wrote that he has been dealing with an issue that has caused SVCHOST to push the CPU to 100 percent usage in clean installs of Windows XP SP3. He writes:

I don't know about anyone else, but within the last year MS did something to Windows update for XP which has caused, even on fresh installs, SVCHOST to RAPE the CPU at 100%. For the past 2 years I've been using the same XP install Sp3 discs. On a fresh install I would run windows updates it would check for updates and under 30 seconds it would ask for the WGA update and then would proceed to show me the other 100 updates. Now even on clean installs SVCHOST molests the CPU at 100% for a good 4+ Minutes before showing you the updates. You click install and then before it downloads them it molests the CPU at 100% for another few mins.

A number of other Neowin forum members have also reported the same issue popping up with their own Windows XP copies in that same forum thread. Microsoft released a patch to fix the exact same bug with Windows XP back in 2007, but that was for the SP2 version of the operating system. The reason for the same bug occurring with Windows XP SP3 has yet to be discovered.

Neowin has emailed Microsoft to see if they have a comment on this bug and if they will have time to fix it before the April 8th, 2014 cut off date.

Via: Neowin forums

Report a problem with article
Previous Story

Microsoft updates Skype for iPhone, iPad with iOS 7-themed interface

Next Story

VLC for Windows 8 passes Microsoft's certification but without its audio output

93 Comments

Commenting is disabled on this article.

Hello. I apply the cumulative security update and did not work for me. Ultimately the only way i could fix this bad bug was by doing this: Computer > Manage > Services > Automatic Updates > Disable

If you don't disable the service it will start up automatically, it must be disabled.

Good luck!
Jose

I am pleased to offer a definitive update on this issue. @michael.ar, you are almost spot on.

This issue comes about because Windows Update is heavily reliant on components of Internet Explorer. If these components are not up-to-date, later versions of Windows Update Agent (that's the engine that scans for and manages updates) may fail or exhibit very poor performance.

For folks that are doing a fresh install of Windows XP, the problem will always reveal itself when you try to do your first Windows Update. By initiating an update via the Windows Update website or enabling automatic updates, Windows will first upgrade Windows Update Agent. You cannot prevent this from happening. After that, Windows Update will fail or perform poorly thanks to the dated components of Internet Explorer 6.

For folks that have an existing Windows XP installation, this problem may still pop up if you have not been regularly updating your Internet Explorer installation.

It is NOT necessary to install a new version of Internet Explorer to resolve this issue. What is actually required is to install the latest cumulative security update for whatever version of Internet Explorer you have installed. This will be IE6, IE7, or IE8 (if you're doing a fresh install of Windows XP it will naturally be IE6). This will upgrade the various components of your Internet Explorer installation. Thereafter Windows Update will perform as it should.

The latest updates are dated October 2013 (as of writing this). Download and install the update that corresponds with your currently installed version of Internet Explorer:

IE6: WindowsXP-KB2879017-x86-ENU.exe
http://www.microsoft.com/en-us...nload/details.aspx?id=40612

IE7: IE7-WindowsXP-KB2879017-x86-ENU.exe
http://www.microsoft.com/en-us...nload/details.aspx?id=40519

IE8: IE8-WindowsXP-KB2879017-x86-ENU.exe
http://www.microsoft.com/en-us...nload/details.aspx?id=40390

For more information (or for details of updates suitable for 64-bit versions of Windows XP) see http://technet.microsoft.com/e.../security/bulletin/ms13-080.

:-)

Michal

I'm experiencing this problem too. Over the last year I have noticed a gradual slow-down of Windows Update Scan on freshly installed Windows XP SP3 virtual machines.

By gradual I mean this: every time Microsoft has rolled out new updates and added them to their inventory, I clearly noticed Windows Update Scan taking longer (on a fresh install of Windows XP SP3) than previously. It used to take 30 seconds. A month later it was 2-3 minutes. A month later again it was 10 minutes. Then 30 minutes. Tonight I waited over an hour. During the scan, 100% of one CPU core is utilized.

This smells to me like the result of poor coding in the scanning algorithm. Perhaps as the number of available updates (that are not already installed) increases, so too does the scan time, seemingly exponentially.

Anyway, after installing the first bunch of critical updates (over 120 of them), Windows Update Scan takes a fraction of the time to detect remaining updates.

My host machine is an i7 3.4GHz so the virtual machines run very fast. Out of interest I wanted to see how long an initial Windows Update Scan would take on an older laptop (can't remember the specs but it's many years old). It took over 4 hours! Because the laptop has a single-core CPU, you could clearly see 100% CPU usage. On the 4-core i7 with HT enabled, you see around 12.5% CPU usage (1/8 of 100%) while the scan is in progress.

I doubt Microsoft has introduced this issue intentionally to help kill off Windows XP, but it wouldn't surprise me if they intentionally don't fix it to help kill off Windows XP.

Hello, I solved the 100% CPU problem using information that are published at the following link:
http://www.ilsoftware.it/artic...100-su-Windows-XP-SP3_10338
The website is in italian but the translation is easy.
After stopping wuauserv services (services.msc) they manually installed Internet Explorer 8 with all of its updates.
** VERY IMPORTANT ** After starting IE8 installation (let's download the right version for your locale from the MS website) you have to CHECK "INSTALL UPDATES" option:
http://www.udel.edu/it/files/h...ernetexplorer/3_updates.gif
Unchecking it will *NOT* solve the problem of 100% CPU.
Please leave the "INSTALL UPDATES" checked.

I also can confirm this problem with an ancient xp machine that has served since 2007 as a TV watching PC. I had identified it was Windows update using restore points and uninstalling the usual suspects and eventually pulling the NIC to prove the point. The aging machine is fine, the new MS updates are at fault and are now disabled. It pains me some many folk in this thread don't see the principle of if "it already works MS should not be breaking it". These are working PCs that have worked for years and still do a great job, it doesn't matter about W7 or Linux, it's about an important principle that MS should not be breaking or undermining these pre-existing computers to manipulate the markets. Change will come undoubtedly, but MS should not be forcing the issue. Conspiracy is a strong word, but you'd hope that now forums like this have pointed out Microsoft's apparent practices here, then MS should\may honour their responsibilities. When they do honour them again, just remember to turn off MSAutoupdates after April 8th, 2014 when the support does finish and sabotage is legally back on the table.

I know it's supposed to be a conspiracy, but could there be some truth in the factor. That Microsoft could place bugs into Windows to make people upgrade.

Was refurbishing 5 Pentium 4 laptops today and came across the svchost.exe cpu usage bug on all of them, so far taking 30 minutes to check for Windows Updates. Cancelled WU on 3 of those laptops and installed the MS13-069 update and can confirm this fixed the issue, WU was pretty much instant after that.

I also ran into it recently and even made a thread about it here, a clean install on a customer's Pentium 4 computer and I could not get Windows Update to work at all. It just sat at checking for updates for over 3 hours before I gave up. I finally got the updates to install after letting the automatic update installer in the task bar find and install them rather than going to Windows Update. In the future if I have to update XP (and I hope I don't) I'll use the WSUS Offline utility.

I've been a fan of this site for many years, but I just signed up for the first time today in order to reply to this thread.

I just ran into this issue on Friday when building up a new XP SP3 VM at work. It was a completely clean install from the MSDN XP Pro (32-bit) SP3 .iso file. The Windows Update site simply errored out (0x8024D000 or something similar). I noticed the high CPU usage, which was starting as soon as I booted the VM (before even going to the Windows Update site). After I turned off automatic updates and rebooted, the CPU usage was normal.

Some searches led me to the following helpful thread:

http://answers.microsoft.com/e...af45-4c91-8131-a9b8676c30ad

The end result was that the problem was resolved by manually downloading and installing the patch associated with MS KB2870699 / MS13-069. This is the September IE Cumulative update, so there will probably be a new one out tomorrow. Be sure to download the version that is appropriate for your OS and browser. In my case, I was running a clean XP SP3, so I needed to get the patch for IE6.

Below are some more links that might be helpful:

KB2870699
http://support.microsoft.com/kb/2870699

MS13-069 (this has the links to the patch downloads)
http://technet.microsoft.com/e.../security/bulletin/ms13-069

Hope this helps! I remember the 2007 issue, and it was frustrating!

Perhaps Warwagon you might think about creating an uptodate winxp install disk that includes these after SP3 updates it's not hard to do and would probably cure your woes of having your CPU raped and pillaged every time you do a clean install try using nLite and add all the relevant updates and have them installed on setup

It's interesting that someone thinks Microsoft is going to spend any time or effort fixing a bug for an OS that is in extended support, especially one that's about to be EOL'ed in 6 months.

When a product is in Microsoft's extended support phase, it does not receive design changes or feature requests at all, and bugfixes (non-security update requests) can only come from customers with a Premier support contract and an extended support agreement in place on top of that (extra money for support, which gets more expensive each quarter).

Since this isn't a security issue, even if it is a bug, Microsoft isn't fixing it for you unless you're a big customer, can prove this costs your business lots of money (and if you're already a big company, you're using SCCM or WSUS for patching), and can make a valid business argument why Microsoft should fix this. Oh, and you need that extended support agreement on top of your existing Premier support agreement as well, and you have to have signed and paid for it by January of 2009 (90 days before mainstream support ended), after which point Microsoft can deny requests for new extended support agreements. If Microsoft did accept a request for extended support after that date (say, today), you have to back pay for all of the quarters of extended support up until today, not just starting today - yes, it's expensive on purpose.

It is 90 days *after* mainstream support ended I think. I think EHSA for some products are also free with Software Assurance (except for per-fix fees).

Burned said,
I dont see this problem. I have nLited my version XP

I like the "official' lite version of Windows Xp: Windows Fundamentals for Legacy PCs

I have the exact same problem with a 2K3 server and windows update. I just live with it.
And before anyone goes on about 'upgrade blah blah', upgrading is not an option. Everything is setup, everything works, everything is compatible with how it runs now, I trialed server 2k8 years ago and found it to be incompatible with software and as a result it had no firewall and the amount of spam received was over 10 times higher.

*sucks thumb*

Im not switching from Windows XP!

[/sarcasm]

I've known about this for awhile myself, its almost always windows update service that is causing the slowdown. Happens when a user doesn't keep their PC up to date. Doing an offline update usually solves the problem then turn on windows update again. Once your up to date it won't happen again.

In sort, its time to upgrade.

I had a problem in Windows 95 where my start button would move to the center of the taskbar.

Had another issue that wasn't fixed until Vista where everything that ran in the system tray did to with SYSTEM level authorization.

Another problem with a dozen language bars on server 2k3.
(there is a hotfix for this, but my organization would rather live with it than patch it).

Blah blah blah.

Point is, there comes a time when we all need to move forward.

This is possibly the oldest news ever. It's caused by activating Microsoft Update when any Office 2003 components are installed. For years now, the fix has either been to get a newer version of Office or get a multi-core CPU and ignore it.

random_n said,
This is possibly the oldest news ever. It's caused by activating Microsoft Update when any Office 2003 components are installed. For years now, the fix has either been to get a newer version of Office or get a multi-core CPU and ignore it.

It's happening on systems without Office as well. I've been refurbishing old systems for work, and have seen this issue right after finishing the XP install.

I wonder if they ever fixed the bug where if you right-click a title bar and don't move the mouse, it pushes the CPU to 100% until you move the mouse or let go of the button.

Have the same problem with various XP machines on our work network for quite a while now. It used to only affect Microsoft Update, but now the problem has spilled over to plain Windows Update as well. Damned annoying to say the least.

as i said before, microsoft should release a new sp4 as a good gesture for those who current using xp and cant update... in my case i have old machines that have less than 512 of ram that cant handle anything after XP

for those who are using windows 7 microsoft should release a new sp too.... there are too much patches and a compilation of patch helps a lot for any tech support or it department

I can't see an SP4, as Microsoft said long ago that SP3 would be the last. An update rollup would have been nice about 12-18 months ago. At this point, there's no reason to do it because Windows XP will be susceptible to new security vulnerabilities as of April 2014 and really should not be run in any networked production environment.

As for Windows 7, I agree. It definitely needs an update rollup or SP2. I think the Sinofsky/Windows 8 philosophy of no more service packs is the reason you're not seeing them. Notice that there haven't even been any patch rollups for Server. It's inconvenient, but I wouldn't expect it to change. From now on, it looks like the only rollups/service packs we'll be getting will be free yearly upgrades on the client and R2s on the server.

A service pack extends the support life of the operating system, so there's no chance in hell of that happening. As xpxp2002 suggested, the best you could've hoped for was an update rollup, but even then, that's a waste of time.

xpxp2002 said,
I can't see an SP4, as Microsoft said long ago that SP3 would be the last. An update rollup would have been nice about 12-18 months ago. At this point, there's no reason to do it because Windows XP will be susceptible to new security vulnerabilities as of April 2014 and really should not be run in any networked production environment.

As for Windows 7, I agree. It definitely needs an update rollup or SP2. I think the Sinofsky/Windows 8 philosophy of no more service packs is the reason you're not seeing them. Notice that there haven't even been any patch rollups for Server. It's inconvenient, but I wouldn't expect it to change. From now on, it looks like the only rollups/service packs we'll be getting will be free yearly upgrades on the client and R2s on the server.

FYI All the updates can be rolled into a new install. There is no need for Microsoft to do this as an additional release. It takes an IT person a few minutes to do this.

In the 'older' days when you couldn't as easily roll the specific updates you wanted into a build, SP were necessary to help IT professionals and OEMs. This hasn't been true for a LONG LONG time, as in almost 15 years.

If it's not a show stopping security bug, I'm sure Microsoft could care less. There's 6 more months left.

I'm also concerned about the language used in Warwagon's report...

Brony said,
Is funny how MS was UNABLE to fix it.

Yes it's the same reason newer technologies aren't backported to legacy OSes. There is a fundamental flaw deep down that would take re-engineering. Something you would do as a requirement in developing a new OS.

And they did, just that.

It's a good thing that XP is now 4 versions behind current, so there's lots of options for folks on XP to switch to.

"Doctor, my hand hurts when I smash it with a hammer!"
"well, stop smashing it?"

Heard about this but haven't experienced it myself.. granted I only have one system left that actually runs XP anymore only due to antiquated hardware and driver issues, not by choice. This thing wasn't state of the art 10 years ago and it shows updates relatively quickly. This is a system that's up to date mind you as far as updates go, I haven't actually had a desire to do a clean install in a few years at least, that I can see taking a while as there's a ton of updates it has to consider.

I've only read what's been posted here as part of the article so I'm not intricately familiar with it, but I'm not sure what the problem is. Seems pretty obvious to me that after a clean install, the CPU's gonna get hogged identifying and installing updates, especially when there is literally well over a hundred of them.

Once the updates are installed, does the CPU usage go down? If so, I don't know that there's a "bug" to be discussed here at all. If someone's just complaining that it's now taking longer than it used to for the update cycle to complete, I'd say that's being a little OCD. What'd be better, throttle the CPU usage to 50% but take twice as long for the updates to get detected/installed?

How often does one need to perform a clean install of XP nowadays anyway? What's the environment here, can't any of it be virtualized, so when **** needs to be blown away, you can revert back to a clean state where the updates are already installed?

Many questions, potentially many answers, but frankly if anyone cared all that much about this, they'd be looking at that forum post, and not the *news* section.

_dandy_ said,
I've only read what's been posted here as part of the article so I'm not intricately familiar with it, but I'm not sure what the problem is. Seems pretty obvious to me that after a clean install, the CPU's gonna get hogged identifying and installing updates, especially when there is literally well over a hundred of them.

Once the updates are installed, does the CPU usage go down? If so, I don't know that there's a "bug" to be discussed here at all. If someone's just complaining that it's now taking longer than it used to for the update cycle to complete, I'd say that's being a little OCD. What'd be better, throttle the CPU usage to 50% but take twice as long for the updates to get detected/installed?

How often does one need to perform a clean install of XP nowadays anyway? What's the environment here, can't any of it be virtualized, so when **** needs to be blown away, you can revert back to a clean state where the updates are already installed?

Many questions, potentially many answers, but frankly if anyone cared all that much about this, they'd be looking at that forum post, and not the *news* section.


For me, and many others, the website never finishes analyzing what updates I need. So it just sits there with the loading bar for hours. You can sometimes get the Automatic Updates client to install updates it's found but it's hit or miss.

Xenosion said,

For me, and many others, the website never finishes analyzing what updates I need. So it just sits there with the loading bar for hours. You can sometimes get the Automatic Updates client to install updates it's found but it's hit or miss.

How did that vital piece of information not make it into this "article"?

If it's fairly common and can be reproduced at will after a clean install, before getting any third-party involved, then I'd say it'd be more productive to contact Microsoft rather than speculate and point fingers in a forum post.

It's probably not the most direct way to go about it, but I'd start by emailing the Defrag Show guys (from Channel 9); they do work for Microsoft, and they're always looking for user submissions. If you can make a good case and they can't figure it out, they know who to talk to go get things escalated.

Accept only about 6 months ago no 100% was taking place. it would check for updates and go to the next stage after about 15 seconds.

This is because the large amount of Updates available for download at this point on Windows Update.

The same happened to me before 2004, with XP SP1. It happened mostly at very slow computers at that time, with 512 MB or less and poor CPU.

Download and installing manually pending updates, and DISABLING Automatic Updates fixes the problem inmediately.

And, at this point, please, Upgrade.

Cheers.

It can't be, because just a few months ago it was showing updates almost instantly. Windows Update, that's it, Microsoft Update instead is a completely different story.

If it was reported to Microsoft, they may have thought it was a joke because when you are using terms such as RAPE or molest, the person who wrote it sounds like a child. And that is if it were ever reported, not Neowin's mail question to their PR people. I doubt they scour the Neowin forum looking for every possible bug, see a joke sounding bug and get right on it.

WhatTheSchmidt said,
If it was reported to Microsoft, they may have thought it was a joke because when you are using terms such as RAPE or molest, the person who wrote it sounds like a child. And that is if it were ever reported, not Neowin's mail question to their PR people. I doubt they scour the Neowin forum looking for every possible bug, see a joke sounding bug and get right on it.

It's warwagon, what else would you expect?

WhatTheSchmidt said,
If it was reported to Microsoft, they may have thought it was a joke because when you are using terms such as RAPE or molest, the person who wrote it sounds like a child. And that is if it were ever reported, not Neowin's mail question to their PR people. I doubt they scour the Neowin forum looking for every possible bug, see a joke sounding bug and get right on it.

I actually walked away from that quote more worried about warwagon's childhood than the bug being described.

WhatTheSchmidt said,
If it was reported to Microsoft, they may have thought it was a joke because when you are using terms such as RAPE or molest, the person who wrote it sounds like a child.

You clearly don't love your CPU as much as you should!

It helps give you visualize what is happening.

When it grabs onto the CPU and at 100% doesn't let go. I think my descriptions are good.

warwagon said,
It helps give you visualize what is happening.

When it grabs onto the CPU and at 100% doesn't let go. I think my descriptions are good.

No they're not, they're hyperbolic nonsense.

warwagon said,
It helps give you visualize what is happening.

When it grabs onto the CPU and at 100% doesn't let go. I think my descriptions are good.

Perhaps "chokes", "clogs", "overloads", etc... would be better words?

Dot Matrix said,

Perhaps "chokes", "clogs", "overloads", etc... would be better words?

Perhaps. But look at how much discussion just the choice of words I used is getting!

It happens to be the Windows Update Agent stuck in some kind of loop, constantly verifying the contents of the "Software Distribution" folder used by Windows Update. I had that same issue with an XP SP3 (with IE8) VM and managed to fix it with a few commands:

net stop “Automatic Updates”

del /f /s /q %windir%\SoftwareDistribution\*.*

net start “Automatic Updates”

wuauclt.exe /detectnow

The above will flush the content of the folder and force start the update service.

And if this problem occurs after a fresh XP install?

After doing this step it will force another WU check from scratch which still takes some time (With 100% CPU), so the bug isn't really fixed...

Wenth said,
Actually I have the same problem on Windows 7 SP1...

I've seen it go nuts on Vista to 7 SP1 for this process as well - anything from a faulty HDD to MS Security Essentials to a misbehaving driver.

But in this case, a raw XP install straight up and running WU causes this issue.
I can't say I've seen that problem with Win7.

It must be a tactic by Microsoft to kick people off Windows XP! Windows XP is in fact a 12 year old OS, it amazes me people are still using it. The last time I used Windows XP was in 2009 and is when I got my new Windows 7 PC!

Edited by Atomic Wanderer Chicken, Oct 7 2013, 4:09pm :

Lone Wanderer Chicken said,
It must be a tactic by Microsoft to kick people off Windows XP! Windows XP is in fact a 12 year old OS, it amazes me people are still using it. The last time I used Windows XP was in 2009 and is when I got my new Windows 7 PC!

I don't think so, this bug has been present during years.
However MS indeed wants to push people to kill XP and buy windows 8.

Isn't this caused by .Net framework installation that didn't finished his job yet ?
Should try opening a Command Prompt and run this:
C:\WINDOWS\Microsoft.NET\Framework\v2. 0.5072\ngen.exe executeQueuedItems

checks headline on frontpage...checks calendar... notices its 2013 not 2003. makes sure not using wayback machine. dumbfounded.

Have you seen XPs market share lately? It is still pretty huge unfortunately and either way XP is still officially supported so they need to fix this.

Svchost executes a lot of different services. You have to find out what is actually executing if you want to understand the problem. It could be linked to something else on your network.

Most of these are caused by the automatic updates service. You can test this by disabling that service and seeing if the CPU usage drops.

Spicoli said,
Svchost executes a lot of different services. You have to find out what is actually executing if you want to understand the problem. It could be linked to something else on your network.

While what you're saying is true, there is a bug of sorts that causes Windows Updates to heavily tax the CPU beyond what is normal. This is what the article is specifically referring to.

I only ever recall a problem with indexing when Vista came out... I remember having to disable it as it chewed your disk IO for hours after a new build. XP only had a basic file indexing service I believe, and I don't recall it ever having issues. At least not for me.

TCLN Ryster said,
Most of these are caused by the automatic updates service. You can test this by disabling that service and seeing if the CPU usage drops.

Agreed. I found that this became MUCH more of an issue if Microsoft Update was enabled versus the standard Windows Update...

TCLN Ryster said,
I only ever recall a problem with indexing when Vista came out... I remember having to disable it as it chewed your disk IO for hours after a new build. XP only had a basic file indexing service I believe, and I don't recall it ever having issues. At least not for me.

XP has an optional component on the disc you can install to get the Content Indexing service, which is mostly used for servers (and is deprecated these days and gone in Win8).

There's also Windows Search 4.0 which you can download separately (used to be called Windows Desktop Search) which adds the Vista SP2 version of the search indexer with the WDS UI.

Neither of those things runs in the svchost process.

TCLN Ryster said,
Most of these are caused by the automatic updates service. You can test this by disabling that service and seeing if the CPU usage drops.

Doesn't WU depend on Automatic Updates service to be running to work?I believe it also needs bits.

soldier1st said,

Doesn't WU depend on Automatic Updates service to be running to work?I believe it also needs bits.

Correct, if you disable Automatic Updates the Windows Update site will not work.

jakem1 said,
Of course there's a fix for this bug. Upgrade.

actually ironically disabling windows updates usually fixes the problem

Som said,

actually ironically disabling windows updates usually fixes the problem

Once April of next year roles around, this could be a solution since windows update would be mostly useless.

Pluto is a Planet said,

Absolutely! Just do manual checks for updates, like once a week.

Because of this issue manual checks for updates often won't work either. It just sits there "Checking for Updates" for all eternity while your CPU roasts. The only way I found that worked thanks to another member was to use automatic updates instead and avoid Windows Update entirely.

Circaflex said,
this is what makes front page news these days on neowin? =/ you guys really reach for a story

Obviously you're being very self-centered. This is a real problem for people and yes, it's still current information as it's an ongoing issue.

Xenosion said,

Obviously you're being very self-centered. This is a real problem for people and yes, it's still current information as it's an ongoing issue.

what?

Circaflex said,
this is what makes front page news these days on neowin? =/ you guys really reach for a story

I was happy to see these on the front page. It might help the bug be fixed.

Circaflex said,
this is what makes front page news these days on neowin? =/ you guys really reach for a story

I agree. A support cut-off in no way has ever meant that all bugs should be fixed.