XP Windows / Automatic Updates SVCHOST.exe 100% CPU .. MS did something.


Recommended Posts

Time to upgrade maybe?

For your information, this is an XP virtual machine running under Windows 7 Pro, which exists to support those applications and hardware which Windows 7 doesn't.  If Microsoft had been more attentive to supporting legacy applications and hardware, I wouldn't need XP at all.

A dumb question perhaps, but how do you turn Automatic Updates OFF?  I'm looking at the Microsoft Update home page, and on the right is a green shield with a check-mark in it, beside which are the words "Automatic Updates Turned ON" -- clicking on that does nothing.  Below it is the link "PIck a time to install updates" but there is no link to turn them off.

I applied this patch [KB2879017] a week or so ago and it fixed my "99% CPU" problem on my XP machine until today.  Now, the CPU load goes to 100% with svchost.exe within several minutes of booting, even if I don't do anything else.  If I kill svchost.exe then i have no network connectivity.

 

 So I installed KB2888505 today, and it seems to have fixed the problem again--at least for now.  Let's see how long it lasts this time.

A dumb question perhaps, but how do you turn Automatic Updates OFF?  I'm looking at the Microsoft Update home page, and on the right is a green shield with a check-mark in it, beside which are the words "Automatic Updates Turned ON" -- clicking on that does nothing.  Below it is the link "PIck a time to install updates" but there is no link to turn them off.

Right click on My Computer and select Properties. Then its the Auto Update tab.

For your information, this is an XP virtual machine running under Windows 7 Pro, which exists to support those applications and hardware which Windows 7 doesn't.  If Microsoft had been more attentive to supporting legacy applications and hardware, I wouldn't need XP at all.

Casualties of war. Microsoft first and foremost has a priority to secure their code. Whatever apps that breaks is on the developer to fix. If they don't, then oh well, there's not much Microsoft can do. Eventually somewhere, you have to draw a line where support gets cut off, and move on. You can't support everything forever.

For your information, this is an XP virtual machine running under Windows 7 Pro, which exists to support those applications and hardware which Windows 7 doesn't.  If Microsoft had been more attentive to supporting legacy applications and hardware, I wouldn't need XP at all.

 

I personally wouldn't blame Microsoft for lazy software developers, but that's just me.  And common sense.

Just joined to report my experiences with this. And hopefully help someone battling the same problems...

 

First run into the problem at the end of last month, on a clean XP SP3 Pro install, same symptoms as reported when wuauclt.exe is run svchost stuck running the CPU at 99%. Clearing SoftwareDeployment folder, running offline updates, and many other solutions didnt help me at all. Disabling Automatic Updates does work but its not an option in my place of work at this is dictated by GPOs, so its just re-enabled when a domain user logs in.

 

Fixed it at the time by installing IE8 (selecting NOT to install updates) then installing KB2879017-x86-ENU.exe IE updates. WSUS then worked as expected afterwards.

 

Now the past two days ive been dealing with another machine, with same problem. The updates above did not help. but repeating the same process and installing KB2888505-x86-ENU.exe in place of old updates solved the problem for me.

 

 

Seems KB2888505 has likely superseded KB2879017. Be interesting to see if the problem occurs again when the next IE update is out.

KB2879017 I provided was sufficent, just KB2888505 (by raynerph), which is newer, resolves problem also.

Thank You  :D

After 3 hours of searching at last found a fix KB2888505 worked for me  :laugh:

( KB2879017 didn't worked in my case :rolleyes:  ) 

 

Whatever happened to Page 8 of this thread?  I get just a blank page.

same here  :huh:   :s

I joined this site to say thank you to the thoughtful and diligent people who have found a solution to this problem.  I'm a computer tech, with a computer repair shop.  This problem was driving me crazy for the past few weeks.  I've read hundreds of forum threads and tried countless different fixes to try and fix this CPU spike problem.  I read over 2 hours worth of tech news and forums every day, and I have had several frustrating computers to work on the past 2 or 3 months.  I very much appreciate this group of people who spent over a month to ferret out a solution to this problem.

 

I began a very frustrating odyssey with a computer on Wednesday, which just happened to be the day after Update Tuesday.  After finding this thread, I tried the October cumulative security update, after I reached that post in the forum thread.  This did not work for me, though it worked for other people earlier in the month.  After that failed, I read more of the thread, and then I tried the November patch, which immediately fixed the problem.  It is obvious that the latest IE8 cumulative security update must be applied in order for the update process to work now.  This is also why it works to reinstall IE8 over the top of itself.  By reinstalling IE8, the latest cumulative security update will automatically be installed (If you leave the download updates box checked).

 

It is amazing to me that Microsoft continues to let this happen. Unless Microsoft decides to fix this issue, which I doubt will happen so close to the end of support, it seems to me that this problem will reoccur immediately after Update Tuesday on every month until Microsoft finishes releasing cumulative security updates to IE8.  I assume that on Update Tuesday (or whenever they issue a new cumulative security update) this problem will reoccur.  It will reoccur for everyone who has automatic updates turned on.  I believe that if automatic updates are turned on, the computer will begin to see the 100% CPU usage, until the time when the update successfully installs itself and the computer is rebooted.  And, I believe that those who check for updates manually will not see this spike until they begin a manual update, at which time, the CPU usage will jump to to 100%, and all updates will fail, until the cumulative security update is installed by manually downloading it and installing it, or by reinstalling IE8 over the top of itself, which should install the cumulative security update along with the program.

 

So, does everybody else think this thing will reoccur every month?

 

Thanks,

Chief

Microsoft seems to look into fixing this bug:

 

http://marc.info/?l=patchmanagement&m=138447194406363&w=2

 

 

 

> Thanks to those who have sent their logs. Thanks to your logs, we found the \
> backend changes that were supposed to be made to fix this weren't made.
> In short, this isn't a bug fix (at least not in the near term). The problem is \
> caused by the Windows Update client evaluating an exceptionally long supersedence \
> chain - something IE6 and IE7 have more than any other version of IE due to their \
> time in market. Each 'link' in the chain doubles the CPU resources needed to \
> evaluate it over the previous version. The chain is so long that the design \
> stymies the WUA client.
> We're working to expire these exceptionally old, dated, unnecessary updates in the \
> chain. The expirations for these didn't happen as planned.
> While I can't provide a date for when this will be done, we know it's an issue \
> affecting customer PCs and we're working to get it out as soon as possible to halt \
> the impact.
> Thanks - and I hope that helps...

 

http://news.softpedia.com/news/Microsoft-Promises-to-Fix-Windows-XP-SVCHOST-Bug-400634.shtml

I just joined to provide feedback on this topic. I'm running an XP machine on SP3 (not a clean install). The machine hung up totally on the most recent (November) set of Windows updates. Confirmed via Sysinternals Process Explorer that the problem was Windows update.

Thanks to raynerph's post, I did the following manually:

Turn AutoUpdate off

Download and install latest version of IE8

Go to Microsoft Update center, download KB2888505 (the latest as of November 15) for IE8 for XP, and install (it's important to download the correct version of this KB file).

Reboot

Start up IE 8, go to Microsoft Update center, and check for latest updates. After about 5 minutes of intensive svchost.exe scanning at 100% CPU utilization, the site returned the list of available updates, which could then be successfully installed (a total of 23 updates for this machine).

Now all is well, but AutoUpdate is still OFF!.

Thanks again to raynerph for his excellent advice.

Thank you for this valuable thread. I work in the IT industry for a storage vendor. We have many problems on native windows servers that relate not tour DSM but to Windows Storport and MPIO bugs which they only grudgingly recognize.

I credit this blog with keeping the pressure on Micorosoft to fix the updated bugs in Win XP SP3 post July system updates.

 

I fixed this with the prescribed method where a re-install of XP SP3 is not possible.

 

 

Step 1 Disabled Auto update but left notification in place

Step 2 Killed svchost at 99% CPU and wuadat.exe

Step 3 1 BITS (intelligent transfer) service was stopped manually restarted it.

Step 4 Uninstalled IE 8

Step 5 Reboot

Step 6 Via Firefox installed KB 287901

Step 7 via firefox installed KB2888505 (believe this  was the key and only released recently!!)

Step 8 reinstalled IE8 and updates

Step 9 Reboot

Step10 upon reboot yellow icon informs me that there are updates

Step 11 XP Security Updates (qty 9) updated and rebooted without incident.

Step 12 Reboot

Step 13 Java dependent (v 7 update 45) was enabled in browser and legacy java app ran (you guessed it Win7 65 bit is supported but only if you downgrade MS Office from 64 to 32 Bit - now you know why I have an XP virtual machine for this one unfortunately critical java app)

Step 14 No Svchost using any CPU above 9%

 

Yeah!!!

Ciber_Ted as of 11/19/2013

 

I credit this blog with keeping the pressure on Micorosoft to fix the updated bugs in Win XP SP3 post July system updates.

 

 

Indeed, if you Google SVCHOST 100% cpu this thread is 4th down on the 1st page of Google search results :D

 

People must be finding it, because ATM this thread has 211,000 views in 2 months or about 3,107 views per day! :D

Indeed, if you Google SVCHOST 100% cpu this thread is 4th down on the 1st page of Google search results :D

 

People must be finding it, because ATM this thread has 211,000 views in 2 months or about 3,107 views per day! :D

Good idea making the thread.

Indeed, if you Google SVCHOST 100% cpu this thread is 4th down on the 1st page of Google search results :D

 

People must be finding it, because ATM this thread has 211,000 views in 2 months or about 3,107 views per day! :D

 

I have seen this thread referenced elsewhere as well. It has some of the best discussion (and work-arounds) I have seen on the Internet on this issue. Its place in the Google search results is well deserved. While I thankfully don't have to support any machines running Windows XP anymore, some of my friends who do have thanked me for pointing them to this thread. It is somewhat disappointing that Windows XP still has enough marketshare to warrant the level of attention this issue has received, but thank you, warwagon, for starting the discussion!

I have seen this thread referenced elsewhere as well. It has some of the best discussion (and work-arounds) I have seen on the Internet on this issue. Its place in the Google search results is well deserved. While I thankfully don't have to support any machines running Windows XP anymore, some of my friends who do have thanked me for pointing them to this thread. It is somewhat disappointing that Windows XP still has enough marketshare to warrant the level of attention this issue has received, but thank you, warwagon, for starting the discussion!

This goes to show that the Neowin forum is still relevant as a compendium of technical knowledge. 

  • Like 2
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • "performance issues? what performance issues?!"
    • Microsoft making much needed change to Windows 11, 10 Patch Tuesday security updates by Sayan Sen Recently, Microsoft delivered its latest Defender patches for Windows 11 ISOs. These definitions are released from time to time alongside the general security updates available during Patch Tuesday. Speaking of Defender, the company has now announced another important change that affects how security updates are delivered to enterprise devices running Windows. According to a recent announcement, Microsoft Defender for Endpoint's endpoint detection and response (EDR) updates will no longer be bundled with the monthly Windows security updates or Patch Tuesdays. Instead the company is shifting delivery of these updates to Microsoft Update, bringing EDR servicing in line with several other Microsoft Defender components. If you recall, Microsoft last year moved PowerShell updates to Microsoft Update (MU) as well since it provides automatic updates for Microsoft products and services. Thus the move is intended to allow Microsoft to deliver EDR improvements and security enhancements independently of the OS's regular monthly update cycle; this should enable faster deployment of protection updates without requiring organizations to wait for the next Patch release. For those unfamiliar, Microsoft Defender for Endpoint's EDR capabilities are designed to help organizations detect, investigate, and respond to advanced threats across managed devices. Keeping these components updated is critical for maintaining protection against evolving attack techniques. The rollout has already began for Windows 10 devices in late May 2026 (last month) and Microsoft says it will gradually expand support to Windows 11 and the remaining supported Windows versions over the coming months. The company expects deployment across Windows 10 and Windows 11 to be completed by fall 2026 or around Q3 of this year. Once the transition is complete, EDR updates will be delivered through Microsoft Update using KB5005292, provided the required prerequisite updates have already been installed. Microsoft is also introducing a new Defender Update Service as part of the change. Following installation of the first update, devices will automatically create a new directory located at %ProgramData%\Microsoft\Microsoft Defender\Defender Update. Microsoft notes that restarts may occasionally be necessary in case of "rare" failure scenarios. For most organizations, the tech giant says no action will be required as long as Microsoft Update is already permitted within their update management strategy. Admins who rely on manually deployed update packages, however, will need to adjust their processes to ensure the new Defender update package is included. Microsoft also recommends reviewing internal documentation and notifying helpdesk and security operations teams about the updated delivery mechanism to avoid confusion during the transition. As a prerequisite, the tech giant notes that systems must be running Sense version 10.8798.25857.1000 or later and have one of the following Windows updates (or later) installed: Win11 24H2 KB5062660 (2025-07 Cumulative Update Preview) Win11 23H2 KB5062663 (2025-07 Cumulative Update Preview) Win11 22H2 KB5062663 (2025-07 Cumulative Update Preview) Win10 22H2 KB5062649 (2025-07 Cumulative Update Preview) Win10 1809 KB5063877 (2025-08 Cumulative Update) Server 2019 KB5063877 (2025-08 Cumulative Update) Server 2022 KB5063880 (2025-08 Cumulative Update) Server 2025 KB5063878 (2025-08 Cumulative Update) As always, organizations should verify that their update policies align with the new servicing approach before the broader rollout reaches all supported Windows platforms later this year. In case of major problems, the EDR update can be rolled back to the inbox version stored in %ProgramFiles%\\Windows Defender Advanced Threat Protection (ATP) using: MpCmdRun.exe -RevertMde -Product Edr -ToVersion Inbox For those who have access to the Microsoft 365 Admin Center portal, you can view the message here under ID MC1381119.
    • My problem with these smart scopes is that IMO they're not really an entrance into astronomy, they're an entrance to looking at pretty(ish) pictures that you take by essentially pressing a button and letting the scope do the work. I still maintain that getting some binoculars or a solid dedicated telescope (which doesn't have to mean expensive) and actually spending time learning the night sky and using a telescope is a much better way to actually learn. But, granted, the learning curve is a bit steeper (as it tends to be).
    • I never played Crazy Taxi before, but this looks like a fun game!
    • The perception of Microsoft Edge is unfortunate as it's a world class browser. I'm not exaggerating when I say it's the best browser I've ever used with its feature set, speed, reliability and advanced security. Running the extension Ublock Origin is a must though to deal with advertising and trackers.
  • Recent Achievements

    • One Month Later
      DJC50PLUS earned a badge
      One Month Later
    • Week One Done
      DJC50PLUS earned a badge
      Week One Done
    • Proficient
      Eric Biran went up a rank
      Proficient
    • Dedicated
      Conjor earned a badge
      Dedicated
    • Week One Done
      Windows Guy earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      493
    2. 2
      PsYcHoKiLLa
      248
    3. 3
      Steven P.
      73
    4. 4
      +Edouard
      69
    5. 5
      neufuse
      68
  • Tell a friend

    Love Neowin? Tell a friend!