Automatic Updates freezing PC (svchost.exe -k netsvcs wuauclt.exe)

I'd imagine this is something that got broken on the last update and is
currently affecting a lot of other people. There is nothing complicated
about my Dell home laptop running XP Home SP2...I barely use it, 8-way
servers at work are more fun to play with. Anyways, I've had Automatic
Updates turned on to download the updates and then prompt me to install for
at least 2 years, with no problems. Yesterday evening (April 10 '07) my
laptop decided to simply freeze - after a hard boot, it froze again within
about a minute.

After some considerable effort to track the offending process and make sure
it's not a virus, I am surprised to find that it is Automatic Updates, which
runs as a service under svchost.exe -k netsvcs. With the updates turned on
as I've had them for years, I can see that service starting, and a few
seconds afterwards the parent svchost process starts clocking 100%,
effectively hosing the machine. This happens within a minute after startup.

Disabling the Automatic Updates service or simply turning automatic updates
off in Security Center gives me my computer back. However, this is not an
ideal solution - that service needs to be running to update even manually,
and when it's started simply by visiting Microsoft's windows update site, the
same issue manifests. Basically, whenever the Automatic Updates service
runs, it hogs all the CPU and thus locks up the machine. I used Process
Explorer and ran through the same sequence of events 3 times to verify this
beyond any doubt...it's also the only thing I can use to kill the offending
svchost process and get control back.

Has anyone else run into this? Do you have a better solution? Please post
if you do. If you don't, go to Control Panel and disable your Automatic
Updates through the Security Center right upon startup, then quickly reboot -
at least you'll be able to use your computer that way.

I can confirm that you are not alone. Hit me yesterday, Patch Tuesday, as
well. It is also affecting all the XP systems in my office. Have been
searching the web all day today with no luck finding a reason or solution.
I have found that it will eventually pass after 15+ minutes. If you go to
the windows update web site the same thing happens and IE can appear to
freeze.

Paul


"javaguru" <> wrote in message
news:818379A2-BEBF-43CF-AFBF-...
> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install
> for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make
> sure
> it's not a virus, I am surprised to find that it is Automatic Updates,
> which
> runs as a service under svchost.exe -k netsvcs. With the updates turned
> on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after
> startup.
>
> Disabling the Automatic Updates service or simply turning automatic
> updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site,
> the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify
> this
> beyond any doubt...it's also the only thing I can use to kill the
> offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please
> post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly
> reboot -
> at least you'll be able to use your computer that way.

Yes, I had this problem with a machine at home and at work. In both cases I
just had to leave the machines for ten (10!) minutes and eventually they came
back to life.

I come to expect this is recent months. Sometimes auto-update seems to get
bogged down and ties the CPU up. It's usually only for half a minute though
this week's patches have been particularly bad.

Yep - I have a Dell Latitude D 505 and experienced amost what you describe:
Microsoft Update ran - keep checking...checking...checking... and all of a
sudden the Laptop freezes up. The only way to close it down was using
CTRL-ALT-DEL and choose reboot or shut down. The circus repeated itself
several times on the evening April 10. I did, however, manage to take down
all important security updates on April 11. I just wonder what caused the
total freeze up of IE 7 and by this the Laptop. Had manually to force down
iexplorer.exe and explorer.exe before reboot could take effect. Could not
even access the process tab to discover what process did cause the lockup....
Anders

"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

Hi Everyone - I'm a network admin for roughly 800 machines and after many
hours of frustration and blog searches, the issue points to how Microsoft
Update interacts with Office updates if you have Microsoft Office installed
on those workstations.
Like many of you, I thought "wow, what a GREAT idea! I'll get to update my
criticals for Both the OS and the Office apps!" BIG MISTAKE - I would
recommend going back to the Microsoft Update site - click on "Change
settings" on the left and go to the bottom and ck option to go back to
"Windows Update" - and POOF svchost now only searches for OS criticals and
while this can still be a rather processor intensive process, it doesn't take
nearly as long and your PC will thank you~
Does anyone know how to deploy this to domain PC's through GP? That is the
biggest problem I have now since I have a few hundred to make this change
on!! Thx!!!

"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

Excellent post.

I have the same issue. It started appearing in February and Hotfix 927891
does not correct it -- only gives my PC a few extra minutes until svchost.exe
grabs 100% of the cpu and the machine locks up.

Just imagine the impact on many folks with PCs without much horsepower -- MS
pushes Microsoft Update out to the masses, then it starts failing without any
apparent explanation or fix. Users struggle to get their machines back and
many disable the automatic update process. Without auto update on the users
never see notice that Microsoft Update has been fixed...

The evil element could not have written a better scenerio! Granted, I was
making an assumption -- that MS Update will be fixed. What a joke.
--
Hugh


"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

I try to help with what I know... and yet I might repeat myself in this forum
but look at that :

Out of this, I can suggest you to have a look there :
http://support.microsoft.com/kb/916089/

But as far as I can read (5hrs+) lot of people still having this issue.
and as far as I know, there is 1 temporary solution for this and its to
disable the "automatic updates" services. Disable until you need it.

Another "solution", which I didn't have tested yet, is this
http://mygreenpaste.blogspot.com/200...rvices-in.html

In other word you separate wuauclt from the svchost so then you'll be able
to lower the priority, therefor, leaves the comp in a usable state.

Hope it helps.


"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

You should deploy WSUS and exclude Office updates from detection. Then with
GPO point internal clients to that WSUS. They won't check for Office updates
since they are not present on WSUS server. Good luck.



Miha

Hi javaguru et al in thread - The following has solved the problem for a
number of folks. This is a general post for all levels of users:


How knowledgable about doing things are you? Do you know how to
start and stop services? How to run a .cmd file? If not, you'll need
access to someone who does to avoid problems. The following assumes you're
on Windows XP. If you're confident about what you're doing, then try the
following first - only if it doesn't work, then there's another level of
stuff that can be done following:

1. Stop and Disable Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.
2. Rename the folder %SystemRoot%\SoftwareDistribution to
%SystemRoot%\OldSoftwareDistribution
3. Open Notepad and create a file containing the following:

REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL


Save this file as 'Wudll.cmd' (without the quotes) to any convenient
location then exit Notepad and double click on the file you just saved. You
should get a 'Sucess' mesage for each of the .dll's listed above.

4. Now Re-enable to Automatic status and then Start each of the services
you stopped before - Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.

5. Now Reboot. Now Reboot Again. (Yes, twice.)

See if that solves it - give it a couple of days. If so, then you can
delete 'OldSoftwareDistribution'. I would request that you post back with
your results. _Only if the problem does re-occur_, then do the following
_exactly_:

1. Go to http://wiki.djlizard.net/Dial-a-fix and download Dial-a-fix
v0.60.0.24 (2006-10-27)

2. Unzip it to a new folder at root with any name, e.g.
c:\Dial-a-fix-v0.60.0.24

3. Double click on Dial-a-fix.exe in that folder.

4. Click on the following:
Options/tooltips (just to get an idea of what it does in each section.
)
Both boxes under Prep
The 'all' (top) box for Sections 2, 3 and 4 (which will automatically
be set when you check 3)
In Section 5, 'Programming cores/runtimes' and
'Explorer/IE/OE/shell/WMP' only.
Click 'Go' . (Some of the re-registrations may take what seems like a
long time for some .dll's - Don't be impatient.)

5. Reboot (if Dial-a-fix doesn't do it automatically at the end). Now
Reboot Again. (Yes, twice.)


See if that does the trick, and, again please post back with your
experience.



MS is well aware of this issue. From a private communication:


"I regret to say that I was told that this known issue requires too much
change to be implemented in a hotfix. A change will instead be implemented
in the next Automatic Updates client, which we are planning to release in Q2
this year."


--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In news:818379A2-BEBF-43CF-AFBF-,
javaguru <> typed:
|| I'd imagine this is something that got broken on the last update and
|| is currently affecting a lot of other people. There is nothing
|| complicated about my Dell home laptop running XP Home SP2...I barely
|| use it, 8-way servers at work are more fun to play with. Anyways,
|| I've had Automatic Updates turned on to download the updates and
|| then prompt me to install for at least 2 years, with no problems.
|| Yesterday evening (April 10 '07) my laptop decided to simply freeze
|| - after a hard boot, it froze again within about a minute.
||
|| After some considerable effort to track the offending process and
|| make sure it's not a virus, I am surprised to find that it is
|| Automatic Updates, which runs as a service under svchost.exe -k
|| netsvcs. With the updates turned on as I've had them for years, I
|| can see that service starting, and a few seconds afterwards the
|| parent svchost process starts clocking 100%, effectively hosing the
|| machine. This happens within a minute after startup.
||
|| Disabling the Automatic Updates service or simply turning automatic
|| updates off in Security Center gives me my computer back. However,
|| this is not an ideal solution - that service needs to be running to
|| update even manually, and when it's started simply by visiting
|| Microsoft's windows update site, the same issue manifests.
|| Basically, whenever the Automatic Updates service runs, it hogs all
|| the CPU and thus locks up the machine. I used Process Explorer and
|| ran through the same sequence of events 3 times to verify this
|| beyond any doubt...it's also the only thing I can use to kill the
|| offending svchost process and get control back.
||
|| Has anyone else run into this? Do you have a better solution?
|| Please post if you do. If you don't, go to Control Panel and
|| disable your Automatic Updates through the Security Center right
|| upon startup, then quickly reboot - at least you'll be able to use
|| your computer that way.

On Apr 15, 9:16 pm, "Jim Byrd" <jrb...@spamless.roadrunner.com> wrote:
> Hi javaguru et al in thread - The following has solved the problem for a
> number of folks. This is a general post for all levels of users:
>
> How knowledgable about doing things are you? Do you know how to
> start and stop services? How to run a .cmd file? If not, you'll need
> access to someone who does to avoid problems. The following assumes you're
> on Windows XP. If you're confident about what you're doing, then try the
> following first - only if it doesn't work, then there's another level of
> stuff that can be done following:
>
> 1. Stop and Disable Automatic Updates, Background Intelligent Transfer
> Service and the Cryptographic Service.
> 2. Rename the folder %SystemRoot%\SoftwareDistribution to
> %SystemRoot%\OldSoftwareDistribution
> 3. Open Notepad and create a file containing the following:
>
> REGSVR32 WUAPI.DLL
> REGSVR32 WUAUENG.DLL
> REGSVR32 WUAUENG1.DLL
> REGSVR32 ATL.DLL
> REGSVR32 WUCLTUI.DLL
> REGSVR32 WUPS.DLL
> REGSVR32 WUPS2.DLL
> REGSVR32 WUWEB.DLL
>
> Save this file as 'Wudll.cmd' (without the quotes) to any convenient
> location then exit Notepad and double click on the file you just saved. You
> should get a 'Sucess' mesage for each of the .dll's listed above.
>
> 4. Now Re-enable to Automatic status and then Start each of the services
> you stopped before - Automatic Updates, Background Intelligent Transfer
> Service and the Cryptographic Service.
>
> 5. Now Reboot. Now Reboot Again. (Yes, twice.)
>
> See if that solves it - give it a couple of days. If so, then you can
> delete 'OldSoftwareDistribution'. I would request that you post back with
> your results. _Only if the problem does re-occur_, then do the following
> _exactly_:
>
> 1. Go tohttp://wiki.djlizard.net/Dial-a-fix and download Dial-a-fix
> v0.60.0.24 (2006-10-27)
>
> 2. Unzip it to a new folder at root with any name, e.g.
> c:\Dial-a-fix-v0.60.0.24
>
> 3. Double click on Dial-a-fix.exe in that folder.
>
> 4. Click on the following:
> Options/tooltips (just to get an idea of what it does in each section.
> )
> Both boxes under Prep
> The 'all' (top) box for Sections 2, 3 and 4 (which will automatically
> be set when you check 3)
> In Section 5, 'Programming cores/runtimes' and
> 'Explorer/IE/OE/shell/WMP' only.
> Click 'Go' . (Some of the re-registrations may take what seems like a
> long time for some .dll's - Don't be impatient.)
>
> 5. Reboot (if Dial-a-fix doesn't do it automatically at the end). Now
> Reboot Again. (Yes, twice.)
>
> See if that does the trick, and, again please post back with your
> experience.
>
> MS is well aware of this issue. From a private communication:
>
> "I regret to say that I was told that this known issue requires too much
> change to be implemented in a hotfix. A change will instead be implemented
> in the next Automatic Updates client, which we are planning to release in Q2
> this year."
>
> --
> Regards, Jim Byrd,
> My Blog, Defending Your Machine,http://defendingyourmachine2.blogspot.com/
>
> Innews:818379A2-BEBF-43CF-AFBF-,
> javaguru <javag...@discussions.microsoft.com> typed:
> || I'd imagine this is something that got broken on the last update and
> || is currently affecting a lot of other people. There is nothing
> || complicated about my Dell home laptop running XP Home SP2...I barely
> || use it, 8-way servers at work are more fun to play with. Anyways,
> || I've had Automatic Updates turned on to download the updates and
> || then prompt me to install for at least 2 years, with no problems.
> || Yesterday evening (April 10 '07) my laptop decided to simply freeze
> || - after a hard boot, it froze again within about a minute.
> ||
> || After some considerable effort to track the offending process and
> || make sure it's not a virus, I am surprised to find that it is
> || Automatic Updates, which runs as a service under svchost.exe -k
> || netsvcs. With the updates turned on as I've had them for years, I
> || can see that service starting, and a few seconds afterwards the
> || parent svchost process starts clocking 100%, effectively hosing the
> || machine. This happens within a minute after startup.
> ||
> || Disabling the Automatic Updates service or simply turning automatic
> || updates off in Security Center gives me my computer back. However,
> || this is not an ideal solution - that service needs to be running to
> || update even manually, and when it's started simply by visiting
> || Microsoft's windows update site, the same issue manifests.
> || Basically, whenever the Automatic Updates service runs, it hogs all
> || the CPU and thus locks up the machine. I used Process Explorer and
> || ran through the same sequence of events 3 times to verify this
> || beyond any doubt...it's also the only thing I can use to kill the
> || offending svchost process and get control back.
> ||
> || Has anyone else run into this? Do you have a better solution?
> || Please post if you do. If you don't, go to Control Panel and
> || disable your Automatic Updates through the Security Center right
> || upon startup, then quickly reboot - at least you'll be able to use
> || your computer that way.

I've fixed this - here you go

http://www.fugnut.com