svchost 100% CPU-Usage after login

Hi,

we have a problem with our 400 Windows-Clients. After booting an login
for the first time on a day the machines freezes for 2 minutes with a
100% CPU-Usage by svchost.exe. We found out by using Regmon that the
svchost checks all updates of the machine in registry. So we think it
has to do with WSUS. In the windowsupdate.log I see nothing special.

Any Ideas?

Greetings
Thomas



2006-11-10 07:49:00 1168 594 PT Initializing simple targeting cookie,
clientId = 4a3d89fd-aec7-4730-8bb3-45590920be36, target group =
LRZ-Intern, DNS name = pie07616.lrz.lrz-muenchen.de
2006-11-10 07:49:00 1168 594 PT Server URL =
http://sus.lrz-muenchen.de/SimpleAut...impleAuth.asmx
2006-11-10 07:50:14 1168 218 AU Forced install timer expired for
scheduled install
2006-11-10 07:51:01 1168 594 PT +++++++++++ PT: Synchronizing extended
update info +++++++++++
2006-11-10 07:51:01 1168 594 PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://sus.lrz-muenchen.de/ClientWebService/client.asmx

1) Turn off automatic WU notifications to quell the svchost disturbance.
2) Keep asking, this will be a big problem next week on download day and
afterwards.
3) Does the manual Windows Updates Site work for you, or does svchost go bonkers
only at the WU site and prevent you from downloading WCU's?

"Thomas Niedermeier" <> wrote in message
news:ej1frj$c16$...
| Hi,
|
| we have a problem with our 400 Windows-Clients. After booting an login
| for the first time on a day the machines freezes for 2 minutes with a
| 100% CPU-Usage by svchost.exe. We found out by using Regmon that the
| svchost checks all updates of the machine in registry. So we think it
| has to do with WSUS. In the windowsupdate.log I see nothing special.
|
| Any Ideas?
|
| Greetings
| Thomas
|

Try deleting the contents of this folder (or the folder itself) & reboot:

C:\WINDOWS\SoftwareDistribution\DataStore

If no joy, try deleting the contents of this folder (or the folder itself) &
reboot:

C:\WINDOWS\SoftwareDistribution
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)


Thomas Niedermeier wrote:
> Hi,
>
> we have a problem with our 400 Windows-Clients. After booting an login
> for the first time on a day the machines freezes for 2 minutes with a
> 100% CPU-Usage by svchost.exe. We found out by using Regmon that the
> svchost checks all updates of the machine in registry. So we think it
> has to do with WSUS. In the windowsupdate.log I see nothing special.
>
> Any Ideas?
>
> Greetings
> Thomas
>
>
>
> 2006-11-10 07:49:00 1168 594 PT Initializing simple targeting cookie,
> clientId = 4a3d89fd-aec7-4730-8bb3-45590920be36, target group =
> LRZ-Intern, DNS name = pie07616.lrz.lrz-muenchen.de
> 2006-11-10 07:49:00 1168 594 PT Server URL =
> http://sus.lrz-muenchen.de/SimpleAut...impleAuth.asmx
> 2006-11-10 07:50:14 1168 218 AU Forced install timer expired for
> scheduled install
> 2006-11-10 07:51:01 1168 594 PT +++++++++++ PT: Synchronizing extended
> update info +++++++++++
> 2006-11-10 07:51:01 1168 594 PT + ServiceId =
> {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
> http://sus.lrz-muenchen.de/ClientWebService/client.asmx

On Fri, 10 Nov 2006 17:28:12 -0500, "PA Bear" <>
wrote:

>Try deleting the contents of this folder (or the folder itself) & reboot:
>
>C:\WINDOWS\SoftwareDistribution\DataStore
>
>If no joy, try deleting the contents of this folder (or the folder itself) &
>reboot:
>
>C:\WINDOWS\SoftwareDistribution

I have been experiencing a similar problem to the OP and your advice
has worked very satisfactorily here - many thanks :-)
--
Howard

Which will work if the Automatic Updates service is not running.
Otherwise, the edb.log in DataStore is in use and one can not delete it.
This applies if deleting the entire Software Distribution folder, also.

Start > Run > type in

net stop wuauserv
Click OK

This will stop the AU service.
To restart it
Start > Run > type in

net start wuauserv
Click OK


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


PA Bear wrote:

> Try deleting the contents of this folder (or the folder itself) & reboot:
>
> C:\WINDOWS\SoftwareDistribution\DataStore
>
> If no joy, try deleting the contents of this folder (or the folder
> itself) & reboot:
>
> C:\WINDOWS\SoftwareDistribution

Howard Harris wrote:
> On Fri, 10 Nov 2006 17:28:12 -0500, "PA Bear" <>
> wrote:
>
>> Try deleting the contents of this folder (or the folder itself) & reboot:
>>
>> C:\WINDOWS\SoftwareDistribution\DataStore
>>
>> If no joy, try deleting the contents of this folder (or the folder
>> itself)
>> & reboot:
>>
>> C:\WINDOWS\SoftwareDistribution
>
> I have been experiencing a similar problem to the OP and your advice
> has worked very satisfactorily here - many thanks :-)

YW & thanks for posting back.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)

Hi,

thank you.

I tried it. Now the CPU takes not all the time 100%, only 5 sec then it
goes down and again 5 secs for 2-3 minutes. Process Explorer shows now
that wuauclt.exe takes CPU time, previous only svchost.exe takes CPU
time. But it takes much longer, because it has to generate the 24 MB
database.edb. The second time I start "wuauclt /detectnow" it gets again
100% CPU.

Also tried a Hotfix http://support.microsoft.com/kb/916089/en-us, but it
became not better.

Greetings
Thomas



MowGreen [MVP] schrieb:
> Which will work if the Automatic Updates service is not running.
> Otherwise, the edb.log in DataStore is in use and one can not delete it.
> This applies if deleting the entire Software Distribution folder, also.
>
> Start > Run > type in
>
> net stop wuauserv
> Click OK
>
> This will stop the AU service.
> To restart it
> Start > Run > type in
>
> net start wuauserv
> Click OK
>
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> PA Bear wrote:
>
>> Try deleting the contents of this folder (or the folder itself) & reboot:
>>
>> C:\WINDOWS\SoftwareDistribution\DataStore
>>
>> If no joy, try deleting the contents of this folder (or the folder
>> itself) & reboot:
>>
>> C:\WINDOWS\SoftwareDistribution

"PA Bear" <> wrote in message
news:%...
| Try deleting the contents of this folder (or the folder itself) & reboot:
|
| C:\WINDOWS\SoftwareDistribution\DataStore

I just deleted this folder and things work again. Thank you for getting me out
of hot water again! :-)

Cymbal Man Freq. wrote:
> "PA Bear" <> wrote in message
> news:%...
>> Try deleting the contents of this folder (or the folder itself) & reboot:
>>
>> C:\WINDOWS\SoftwareDistribution\DataStore
>
> I just deleted this folder and things work again. Thank you for getting me
> out of hot water again! :-)

YW, again!

It worked! Thanks!

Robert

"PA Bear" wrote:

> Try deleting the contents of this folder (or the folder itself) & reboot:
>
> C:\WINDOWS\SoftwareDistribution\DataStore
>
> If no joy, try deleting the contents of this folder (or the folder itself) &
> reboot:
>
> C:\WINDOWS\SoftwareDistribution
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
>
>
> Thomas Niedermeier wrote:
> > Hi,
> >
> > we have a problem with our 400 Windows-Clients. After booting an login
> > for the first time on a day the machines freezes for 2 minutes with a
> > 100% CPU-Usage by svchost.exe. We found out by using Regmon that the
> > svchost checks all updates of the machine in registry. So we think it
> > has to do with WSUS. In the windowsupdate.log I see nothing special.
> >
> > Any Ideas?
> >
> > Greetings
> > Thomas
> >
> >
> >
> > 2006-11-10 07:49:00 1168 594 PT Initializing simple targeting cookie,
> > clientId = 4a3d89fd-aec7-4730-8bb3-45590920be36, target group =
> > LRZ-Intern, DNS name = pie07616.lrz.lrz-muenchen.de
> > 2006-11-10 07:49:00 1168 594 PT Server URL =
> > http://sus.lrz-muenchen.de/SimpleAut...impleAuth.asmx
> > 2006-11-10 07:50:14 1168 218 AU Forced install timer expired for
> > scheduled install
> > 2006-11-10 07:51:01 1168 594 PT +++++++++++ PT: Synchronizing extended
> > update info +++++++++++
> > 2006-11-10 07:51:01 1168 594 PT + ServiceId =
> > {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
> > http://sus.lrz-muenchen.de/ClientWebService/client.asmx
>
>