Re: problem connecting windows update - CPU 100% svchost.exe
- From: MoosieAZ <MoosieAZ@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 12 May 2008 08:17:04 -0700
Chuck, the problem I had with the 2nd machine (Dell laptop) did not get
resolved as easily as the situation I described earlier. This time it seems
to
resemble the situation you describe. I did finally get it fixed after many
hours
of searching and trying different approaches. Here is what I did:
1) First I tried to let it run itself to health, which it did, but only
until the next
boot and then it started all over again.
2) After it had cleared up on its own I decided to force a Windows Update
cycle to see if that would trigger the problem again; it did, but I let it
run. I
didn't time it because I was doing other chores around the house, but about 2
hours later I checked and the screen indicated that some update
[unidentified]
had been applied AND there was a message on the screen inviting me to
download and install SP3.
3) Since I had nothing to loose I did select to download and install SP3 (I
snoozed my CA Antivirus program, as several people reported difficulties with
SP3 conflicting with A/V and antispyware programs). To my amazement, it
seemed to work. When I checked on the progress a while later, it was waiting
at a screen which told me to restart the machine. I did so, but after the
reboot, the same damn problem with 100% CPU was still with me.
4) I spent another hour or so checking different forums and noted a growing
number of posts relating to this issue. Some suggested that Microsoft was
attempting to screen millions of PCs before forcing out the SP3 update via
automatic update; I know that sounds like malcontents spinning a conspiracy
theory, but it did make some sense. Clearly Microsoft did something via the
update process to trigger the problem on my machine (and the laptop) - it had
been running just fine until Wednesday morning. I looked at so many forums
and posts that I can't say with certainty, but I believe I finally found
something
that worked on the dslreports.com site. One poster said they had done many
of the things I had already done, but they decided to delete the
SoftwareDistribution folder in the Windows directory, and would post back
later to provide an update.
5) Although I was cautious, I decided to try that on the problematic laptop.
I
stopped the windows update service (to release the folder), then I just
renamed C:\Windows\SoftwareDistribution to
C:\Windows\SoftwareDistributionX and then I rebooted the machine. For the
first time in days it started normally, AND it seemed to be running quicker
than
it had originally. Perhaps SP3 does make a difference. I checked the
Windows directory and found a brand new SoftwareDistribution folder in
addition to the original I had renamed. Anyway, since it seemed to be
running
normally I decided to take a chance and run a Windows Update; it ran and
found a few non-critical updates so I allowed it to download/install them.
That
too worked normally so I ran it once more and it now found a critical update
for Windows Media Player 11, which had been installed in the previous run.
It
installed the update and the system seemed to be fine. I rebooted once more
to make sure, and sure enough, everything appeared normal.
That was a long story, but not nearly as long as the hours spent on finding a
resolution between Friday and late Sunday evening. My overall conclusion is
that this was no freak accident. Someone within Microsoft approved some
process to go out via Windows Update [true reasons unknown] and that
decision had unintended consequences for many people. Will Microsoft [if
they monitor these posts] step up and come clean? Probably not, but it would
sure as hell be refreshing.
Good luck.
"Chuck" wrote:
Abruptly on Thursday (5/8/2008) my wife's laptop, a 16 month-old dual-core.
ThinkPad with XP SP2, began an extended run at 100% CPU like many of the
other incidents described in this article, most notably that of MoosieAZ. I
traced the problem to an instance of the svchost.exe process and am dismayed
to report that it finally retired into the background after 47 minutes of CPU
time. Further, it executed several hundred BILLION I/O Read Bytes. Yep,
MINUTES and BILLIONS. I can't possibly imagine what operation could consume
such resources and still run to apparent completion. Seems like a process
that asks "Are these few/dozen/hundreds DLLs up to date?" should be able to
answer that question in a mere fraction of the time . . . and resources.
This behavior repeated itself everytime she restarted the laptop. (This
occurs frequently, since her habit is to turn off the machine when she's
done with any usage session. I realize some pain could be avoided by leaving
the laptop running, but that's not the point.) After several 47 minute
cycles on subsequent start-ups, the computer seemed to have been happy with
the work it performed and, per the System Event Log, indicated that about a
dozen Office 2003 updates were SCHEDULED for installation at 3:00 a.m. on
5/10/2008. Most of the updates seemed to be security related.
We left the laptop on over night so it could plow through the 3:00 a.m.
installation, which logs indicate it accomplished successfully, though I have
no CPU or I/O stats to report.
I thought we were clear of the problem, but the same 100% CPU behavior began
again this morning (Sunday, 5/11/2008). Armed with a little more knowledge
of the potential culprit, I was able to confirm that a svchost.exe instance
was indeed racking up the CPU and I/O, the former of which rivaled the System
Idle Process. From Process Explorer (procexp.exe) I confirmed that
'wuauserv' was a member of the svchost instance and was able to successfully
kill 'wuauserv'. The system recovered in a matter of seconds and the
computer returned to its normal responsiveness.
I can confirm that KB 927891 was delivered on 5/23/2007, not too long after
the initial post on this thread and presumably as a result of Windows Update
performing properly. I'm not certain whether it was successfully installed,
though. The KB927891.log file indicates fourteen files were copied, but the
log also contains twenty consecutive lines of "KB927891 encountered an error:
The update.ver file is not correct." near the beginning and scattered other
"failure" messages throughout.
Regarding any updating of Windows Update Agent to 3.0, I can only report the
dates and internal versions of the following "wuau..." files in
C:\Windows\System32:
wuauclt.exe 07/30/2007 07:19 PM 7.0.6000.381
(winmain(wmbla).070730-1740)
wuauclt1.exe 05/26/2005 08:16 AM 5.8.0.2469 built by:
lab01_n(wmbla)
wuaueng.dll 07/30/2007 07:19 PM 7.0.6000.381
(winmain(wmbla).070730-1740)
wuaueng1.dll 05/26/2005 08:16 AM 5.8.0.2469 built by:
lab01_n(wmbla)
wuauserv.dll 08/04/2004 08:00 AM 5.4.3790.2180
(xpsp_sp2_rtm.040803-2158)
I present this information in as much detail as I can muster because it
seems our symptoms align well with described problem, but it disturbs me that
most of the posts on this thread date back to May 2007. I would have
expected that Microsoft would have resolved the problem in less that twelve
months. The laptop has been on Automatic Updates since shortly after we
received it, although I only installed Office 2003 on it a few weeks ago.
I am reluctant to proceed with the (re?)installation of KB 927891 and update
to Windows Update Agent 3.0 described earlier because it seems like it is old
guidance. How do we get this problem resolved?
- References:
- Prev by Date: Re: SP3
- Next by Date: Re: SP3
- Previous by thread: Re: problem connecting windows update - CPU 100% svchost.exe
- Next by thread: Re: problem connecting windows update - CPU 100% svchost.exe
- Index(es):
Relevant Pages
|
