XP Windows / Automatic Updates SVCHOST.exe 100% CPU .. MS did something.

[+therealDamien Subscriber¹]

 

 

seems to be affecting systems with fresh installed xp sp3

 

and systems installed with xp sp2, then sp3 download and installed dont seem to have the problem as much

 

 

what I did..

 

install xp with sp2 fresh

 

install internet explorer 8

 

download windows update agent from microsoft download center

 

run windows update. it will say that it needs to update the updater....install

 

run windows update. says it needs to download installer 3.1 and wga and another file(cant remember).  and then it works.

 

 

the last step for some reason with xp sp3, its not downloaded all the required files. and thats why it taking so long to scan,

[+Warwagon MVC]

Okay so i'm just testing this now.

Made a new VM in ESXi, Installed a fresh copy of XP SP3 with no changes, updates, settings or anything.

 

Changed WU to "notify only", and waited with Task Manager open.

After about 3 minutes of brief spurts ranging from 0 to 25% activity on svchost.exe I noticed that wmiadap.exe got called and immediately after that, svchost.exe locked on 99% CPU use. (The wmiadap.exe process closed soon after)

 

Going to try perguife then Lasoto's suggestions shortly.

 

 

Update 1 : perguife's suggestion failed to work, CPU locked at 99%. Trying Lasoto's suggestion next.

 

Update 2 : And Lasoto's suggestion hasn't worked either. CPU just locked at 99% again.

 

Any more ideas?

 

How long is it locking for you?

 

 

I'm currently working on a womans XP machine who said it kept freezing, well I logged in and that process is hung at 100% it could hardly install updates it was just strangling the CPU.

[Raa]

How long is it locking for you?

 

 

I'm currently working on a womans XP machine who said it kept freezing, well I logged in and that process is hung at 100% it could hardly install updates it was just strangling the CPU.

I leave it for about 2 minutes at 100% before I decide that it's hogged enough CPU, then I "net stop wuauserv" and instantly my CPU idles.

 

After "net start wuauserv" and "wuauclt /detectnow" it takes about 15 seconds before the CPU goes back into 100% again.

 

 

Have also tried having the root certificate update installed - same result.

 

 

So I left it at 100% CPU. After 7 minutes solid, it went back to normal and said I had updates available. Ridiculous.

Edited October 11, 2013 by Raa

[+Warwagon MVC]

I leave it for about 2 minutes at 100% before I decide that it's hogged enough CPU, then I "net stop wuauserv" and instantly my CPU idles.

 

After "net start wuauserv" and "wuauclt /detectnow" it takes about 15 seconds before the CPU goes back into 100% again.

 

See and people thought I was nuts!!!!

[jancepelak]

Hi all folks,

 

worked for this problem 20-30 hours and lot of "solutions" doesnt worked for me.

IE8 + KB2870699 doesnt work

IE6 + KB2870699 the same result

IE8 only the same solution.

... and, with simple install from scratch (WinXPp SP3) ... unable even to run Windows Update website.

 

The solution working for me:

1. WindowsUpdateAgent30-x86.exe (enabling WU web, actual WUagent)

2. KB2870699

3. kb892130.exe (manually installing WGA)

4. KB898461 (???? not sure)

5. KB2879017

reboot and .... working WU website working

 

Add 1,2) link found at https://www.neowin.net/news/svchost-bug-still-spikes-cpu-at-100-6-months-before-windows-xp-support-cut-off, exactly Lund, 08 October 2013 - 02:47

Add 4,5) simply search M$ website

Add 3), tricky little bit. I wasnt able to download{search it from MS, so I run 1-2hour WU process and analyze c:\Windows\WindowsUpdate.log, the direct link has been mentioned.

 

Note 1: Tested on WinXP Pro/Ho, SP2 OEM disk + SP3

Note 2: I have read plenty of solutions these days. Its a difference between solving 100%CPU usage on actual XPs and solving problem on clean install. This is solution for the second one. (And maybe workaround for the first)

Note 3: I have analyzed and experimented with a lot of EXEs KB123456.... and make BAT file installing tens of KBs. Since I add IE8 installation, it failed again (CPU100%). My advice for clean installs - make these 5 steps with IE6, enable WU web and THEN... IE8.

 

Hope this help someone, let me know.

And sorry for poor english

 

Jan

 

 

[Raa]

<snipped>

 

Well well well. We seem to have a winner!

 

After performing steps 1 through 5 exactly as written, rebooting, NOT installing IE8 yet, and setting WU to notify me only...

It took about 2-3 minutes, the CPU did bump to 100% for a few seconds, and then I got a nice little notification saying "New updates are available!"

 

So for a raw XP SP3 install, it seems this finally did the trick.

 

URL for files used was (correct at time of posting):

1) http://go.microsoft.com/fwlink/?LinkID=91237

2) http://www.microsoft.com/en-us/download/details.aspx?id=40069

3) http://www.download.windowsupdate.com/msdownload/update/software/crup/2008/04/windowsxp-kb892130-enu-x86_72e487d115be77f49f64053893

a23ecb58bc59cb.exe

4) http://www.microsoft.com/en-us/download/details.aspx?id=655

5) http://www.microsoft.com/en-us/download/details.aspx?id=40612

 

 

 

Update : And it's broken... Wait, no it's okay I think?

I did it this time... After successfully installing IE8, I decided to delete the SoftwareDistribution folder to make WU refresh itself. After that, the CPU once again locked at 100%.

I installed KB 2870699 for IE 8 (didn't reboot) and KB 2879017 for IE 8 then rebooted. Deleted SoftwareDistribution again for a test, ran another WU check.

I got a CPU lock at 100%, but only for around 30 seconds or so, then got the usual notification about available updates.

 

I think that's enough testing for today. Hopefully that gives people a bit of a life-line to try and troubleshoot. Admittedly this is for fresh installs of XP, which I don't imagine there will be that many now.

Edited October 11, 2013 by Raa

[VmQOrHgxLE]

I here to confirm this trouble.
I had this problem on ALL XP machines (Home, Pro, English, Russian, SP3, preSP4 with all integrated updates also affected).

I installing a lot of XP every month, this problem started six months ago.
All above methods is not decision, because the next time when MS release new updates, CPU will again 100%.

We need wait a patch from MS.

[jancepelak]

I here to confirm this trouble.

I had this problem on ALL XP machines (Home, Pro, English, Russian, SP3, preSP4 with all integrated updates also affected).

I installing a lot of XP every month, this problem started six months ago.

All above methods is not decision, because the next time when MS release new updates, CPU will again 100%.

We need wait a patch from MS.

 

For me, the trick, that works is: By my method (#81, corrected by Raa) .... you can solve initical problem how to access any WU by website. I do NOT use any of these My Computer / Automatic updates settings. I simply switch it off and use WU ONLY in IE6 and this is 100% working even after next WU hit (install IE8) and next (some IE8 depended patch).

 

As for my personal feeling - since MS can "add" anything into WU process that I do not want to be installed, for me AND for clients of mine (which anyway are not able to evaluate whats really neccesary and whats a garbage) I do WU only manually and this solution is OK for me. (OK, maybe 'm heretic, but lets say: when for the last time you saw really wide affecting zero-day exploit in XP?) As I can just guess, when you "reset" software distribution - you force WU web to evaluate genuiness again and the WGA process (KB892130) IS THAT problematic part.

Anyway - using manual WU web only - this is permanent solution for me.

 

Jan

 

note: KB2870699 with IE6 - just process in my case. Do the simple IE8+KB2870699 - result with: "not for IE of your version", at least with my binaries (Czech, -CSY suffix). This was the major difference between plenty of "solutions" on web forums and my experience. Not sure, if this is important.

[Max Norris]

Huh, will have to retract my earlier "seems to work for me" comment. Only system left in the house that's running XP is an old Samsung Q1 tablet, got around to running updates on it this morning out of curiosity and sure enough, it took quite a while to "think about it" before giving me a list of updates, the service was hitting the CPU hard. Originally attributed it to "well, it's a f'ing 800MHz Celeron having to process a bajillion updates", but I don't remember it taking (at least) 4-5 minutes to do it either. I think it was originally installed with an XP Tablet Edition SP2 ISO and later updated to SP3.. it's been so long I can't be 100% sure. WGA has never been installed on it if it matters.

Personally not worried about, I don't really use the thing anymore nor do I have any desire to ever use XP again, I figure (in my case) worse comes to worse the problem will sort itself out in 6 months one way or another. Not being snarky but I personally wouldn't expect an official fix for it.. EOL is literally just around the corner and it won't be a problem anymore.. update to the end, disable automatic updates, never bothered by it again.

[bflmpsvz]

Well well well. We seem to have a winner!

 

URL for files used was (correct at time of posting):

1) http://go.microsoft.com/fwlink/?LinkID=91237

2) http://www.microsoft.com/en-us/download/details.aspx?id=40069

3) http://www.download.windowsupdate.com/msdownload/update/software/crup/2008/04/windowsxp-kb892130-enu-x86_72e487d115be77f49f64053893

a23ecb58bc59cb.exe

4) http://www.microsoft.com/en-us/download/details.aspx?id=655

5) http://www.microsoft.com/en-us/download/details.aspx?id=40612

 

I encountered this problem today. The last successful Windows update was in 02 September 2013. Today I used only some updates above: 2) and 5) (the rest I had installed already or newer version).

And bingo! After reboot, updates works again.

[TierOne]

2. KB2870699

[...]

5. KB2879017

 

My theory is that manually installing KB2879017 (this month's cumulative IE update) was the actual trick and that the reason why manually installing KB2870699 (September's cumulative IE update) no longer prevents the update service from pegging the CPU for so long is because it is no longer the most recent cumulative update.  In other words, I suspect that the above instructions will not be a permanent fix and that we will be back to the same problem again when the next cumulative IE patch is released.

 

I don't think there's anything too magical about manually installing the most recent cumulative IE update other than it's just cutting down on the update service's workload.  I've noticed that the update service on machines with Microsoft Office installed still pegs the CPU pretty bad even after doing the above.  There's probably some Office patch(es) that I could manually install each month to help further ameliorate the issue on these machines, but at some point it becomes faster to just wait it out.  Similar caveats may apply for machines with .net installed or other Microsoft products.

[ANON86364]

I have a few clients who have phone systems which use Windows XP Embedded. Those computers are now having issues as well. Automatic Updates were set to notify only. I went to install updates AU showed in the taskbar and the CPU just pegged out at 100% to the point where calls were being dropped (VoIP system). Had to disable the services and set AU to off.

 

So, to summarize the key point here: Before the issue was thought to be limited to the WU site but I had the AU client do the same. AND this is NOT a new install. This is an old install that simply needed about 15 updates.

[tricky_1]

First Post , please be gentle... :rolleyes:

 

Hi all 

 

I`ve just joined the forum and i`m also experiencing this problem on 3 separate computers all running XP with service pack 3.

 

I`ve not got a solution to this problem , but i thought i`d just let you know how it has affected me .

 

As i said i have 3 computers , the main one i use is running XP Home Edition , the other 2 are running XP Professional.I basically only use the main one which i`ve kept updated manually as i`ve always had Autoupdates disabled .

 

Ok, so here is my experience, I updated my main computer ..(which is a lowly Pentium P4 2Ghz , but it serves me well)..on the 2nd of October and all went well, it downloaded updates and installed them as normal.

 

Last night i thought i might aswell update my other 2 computers also as i did a clean install of XP Professional Service pack 3 on both of them about a Year ago and haven`t used or updated them at all, BUT at the time i did check for updates on both and they both reported that a heap of updates were available ...i didn`t download any.

 

Btw, both machines are AMD Athlon processors , one is a 1.6Ghz processor the other is a 2Ghz.

 

Last night i tried to first update the 1.6GHz and got the SVCHost High usage problem , thinking it might be the computer playing up i tried the 2Ghz one and had the exact same problem also.

 

No matter how long i waited...( and i waited for over an hour )....the computers would just show the "checking for updates" bar. I then tried with my main computer and that now does exactly the same too .

 

I`m guessing that what has already been said here is that it must be a Microsoft "mess up" as i was able to install updates on my main computer only last Week and now i can`t, ALSO my other 2 computers were able to do so but now can`t and they haven`t had ANY updates since install that could have caused this problem to occur.

 

I`ve tried a few "fixes" i`ve found on the internet but none work for me , i think what other people have said might be true , that Microsoft have done this to make us jump to a newer OS ....or am i thinking with my conspiracy hat on?     

 

One way or another i hope Microsoft ...or someone finds a proper solution to this.

[Susliks]

If reinstalling WinXP or deleting updates database(datasource.edb) because of corruption these two scripts could help to not download unwanted updates again.

 

HideKBs-XP.vbs - hides unneeded/fake updates: "Windows Genuine Advantage Notification (KB905474)" and
"Microsoft Browser Choice Screen Update for EEA Users of Windows XP"

 

List-hidden.vbs - Shows list of updates which are hidden by user.

 

 

Also had 100% usage on my XP machine. Installing all the latest updates did the trick but it took long time :pinch:   So Jeff250 could be right that this problem is at Microsoft update server side and not XP.

XP-update-scripts.zip

[francescob]

12th October 2013, the machines rise. Windows Update becomes self-aware at 2:14am Eastern Time and launches updates against Russia.

[Ulpian]

Latest cumulative patch for IE8 solved problem here !

[pebas]

Latest cumulative patch for IE8 solved problem here !

 

Worked perfect for me, finally!

Thank you.

[jancepelak]

Latest cumulative patch for IE8 solved problem here !

 

Not for me. As mentioned before, for clean install I solved problem. (And my solution presumed IE6 installed before process)

For running systems, those with IE8, KB2879017 not working....

I am not sure about exact message unlocalized back from Czech to English, but it report: not applicable for your browser version. (IE8.0.6001.18702)

I have studied KB2879017 MS bulletin again, where is written, that KB 2870699 has to be also installed - no effect. (Also "not for your version")

MS also provided some FixIt (51001 and 51002), also without any progress....

 

So, still unsolved for running systems.

Any ideas?

 

Jan

Note: as somebody mentioned before, WU remain in infinite CPU100% - thats not true, at least in 3 computers, I have tested. In my searching of solution, I have passed this - 1 or on slower computers 2 hours of 100%CPU, but finally it has been finished (and patchs detected on WU site). This is not solution (and 'm not sure if this will come later again), but for those, who work just with one computer - this is .... semi solution, just let the CPU100% / WU run overnight. (And let us in here know, how long does it take)

[jancepelak]

Not for me. So, still unsolved for running systems.

 

Wow, finally, I made progress.

 

Maybe, this is the problem only for some localizations....

When Ulpian reports It worked, I clicked link, read the KB number and search it in another computer (connected by VNC) as www.microsoft.cz - search KB2879017 and used that KB exe - with no success.

But, later, I also tried link exactly as written in Ulpian message - and patch, that comes by this link - is quit different - AND WORKING.

I knew MS detect browser/OS/locales and serve different KB binaries but didn't thought this can matter. It matter.

 

For info:

KB, I have worked first (with no success) was: WindowsXP-KB2879017-x86-CSY.exe (4,2MB)

KB in Ulpian message (successful) was exactly: IE8-WindowsXP-KB2879017-x86-ENU.exe (9,6 MB, by the way)

 

Sounds me like, MS still working on solution in some localizations....

[Praetor]

funny, i have a XP VM that i use every once in a while and it's completely unaffected by this; in fact i installed this weeks updates and it was all good (by contrast, my Windows 8 laptop installed 41 updates at once and one of them took 4 hours(!) to install).

 

gonna try installing a new VM in my Hyper-V server this week just to see this issue happening and what causes it.

[Ulpian]

@jancepelak

 

I used Polish version and it's working...

[tgp1994]

 

Hi to all  :)

 

I found a solution !!!

 

1. Install fresh copy of Windows xp sp3

2. Install Internet Explorer 8  (without updates !!!)

3. Install this update kb2870699

 

 

 

And you are done :) No more 100% usage of svchost.exe

 

 

 

I just wanted to report that installing Internet Explorer 8 was all that I needed to do to get windows update working.

[michael.ar]

I solved the problem by installing Windows XP SP3 in the following way:

- stopped wuauserv service

- installed IE8 enabling installation of all updates

- rebooted my system

( source: http://www.ilsoftware.it/articoli.asp?tag=Windows-Update-SVCHOST-e-CPU-al-100-su-Windows-XP-SP3_10338 )

[phasedinone1]

Maybe this will help someone...  I had a hard disk failure in a Dell laptop running XP meaning replacement was needed. The XP disk reinstalled from was XP2 with Internet Explorer 6.  Following installation of the operating system and drivers, and getting the wireless adapter installed the next step was antivirus - and Norton 360 Premier requires IE8 to download it. So I installed IE8 and the cumulative updates. Next to get Windows or Microsoft Update to work you need XP SP3. So I downloaded and installed SP3. I couldn't get updates to work. I got the searching interminably for updates screen, the 100% CPU problem and the svchost.exe service was the problem (if I managed to turn it off with services.msc the 100% CPU would go away).

 

I also established that the update process seemed to start for a minute or two then hang with 100% CPU.

Tried all sorts of solutions you will find on this and other sites to no avail. A whole weekend wasted!

 

Then I tried reinstalling Internet Explorer 8 over the top of the existing IE8. YAY! Success! First the windows update site required installation of KB898461 and then launched into installing the many updates expected.

 

All makes sense, doesn't it! While IE8 appears to install ok on XP SP2 and works, it really must be intended for installation with SP3 hence the need to reinstall after SP3 is installed.

[francescob]

Did the latest batch of updates made .NET Framework 3.5 on XP an high priority update even for users with no framework installed? WTF?