svchost & Microsoft Updates

I am having a very weird issue with Microsoft Updates and a rogue svchost
process on my laptop. When I boot up the laptop, the processor utilization
reaches 100% immediately and continues to stay peeked at 100% unless I kill
it from the task manager. The svchost process will come back in full force
after I kill it if I try to run a Microsoft update, so I believe it is an
issue with the updates service.

I am not getting any error messages, just horrible pc performance. Once in
a while I will get this error from the MS Update website: The website has
encountered a problem and cannot display the page you are trying to view.

I know I can just reimage the PC, but don't want to go there unless I have
to. So far I have,

1. Run complete virus, adware, and spyware scans from regular mode and safe
mode. Found none. Also ran a Macafee and Norton web scan just to be sure.
Also found nothing.
2. Gone to the MS updates website and installed a few hotfixes which had to
do with MS update and processor utiliization which have done nothing.
3. Manually updated the PC via the MS update website.
4. Turned off updates, rebooted, manually updated via the website,
rebooted, re-enabled auto updates.

Does anyone have any additonal advice to help me fix the issue besides
reimaging the PC?

sorry....the code is actually 0x8DDD009

"Anthony" wrote:

> I am having a very weird issue with Microsoft Updates and a rogue svchost
> process on my laptop. When I boot up the laptop, the processor utilization
> reaches 100% immediately and continues to stay peeked at 100% unless I kill
> it from the task manager. The svchost process will come back in full force
> after I kill it if I try to run a Microsoft update, so I believe it is an
> issue with the updates service.
>
> I am not getting any error messages, just horrible pc performance. Once in
> a while I will get this error from the MS Update website: The website has
> encountered a problem and cannot display the page you are trying to view.
>
> I know I can just reimage the PC, but don't want to go there unless I have
> to. So far I have,
>
> 1. Run complete virus, adware, and spyware scans from regular mode and safe
> mode. Found none. Also ran a Macafee and Norton web scan just to be sure.
> Also found nothing.
> 2. Gone to the MS updates website and installed a few hotfixes which had to
> do with MS update and processor utiliization which have done nothing.
> 3. Manually updated the PC via the MS update website.
> 4. Turned off updates, rebooted, manually updated via the website,
> rebooted, re-enabled auto updates.
>
> Does anyone have any additonal advice to help me fix the issue besides
> reimaging the PC?
>

Courtesy of MVP Emeritus Ottmar Freudenberger:

First, install this fix: http://support.microsoft.com/kb/927891

Now install the newly released 'standalone' version of Windows Update Agent
3.0, v7.0.6000.374, for 32 bit machines (*not* Vista or any x64 version of
Windows!):
http://download.windowsupdate.com/v7...gent30-x86.exe

The MS update team believes that this solves all three svchost problems that
folks have been experiencing. See
http://blogs.technet.com/wsus/archiv...update-on.aspx

Also see
http://www.bleepingcomputer.com/blog...showentry=1071
(First try the steps posted May 4th at the beginning of the article.)

Workaround: Change the default from Microsoft Update to Windows Update: Go
to Microsoft Update > Click on Change Settings in left pane > Scroll to
bottom of page > To Stop Using Microsoft Update > Disable Microsoft Update
software and let me use Windows Update only (check). cf.
http://support.microsoft.com/kb/901037

With Windows Update as your default, you will need to check in at Office
Update to keep your Office applications fully patched:
http://office.microsoft.com/en-us/do...incatalog.aspx

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

Anthony wrote:
> I am having a very weird issue with Microsoft Updates and a rogue svchost
> process on my laptop. When I boot up the laptop, the processor
> utilization
> reaches 100% immediately and continues to stay peeked at 100% unless I
> kill
> it from the task manager. The svchost process will come back in full
> force
> after I kill it if I try to run a Microsoft update, so I believe it is an
> issue with the updates service.
>
> I am not getting any error messages, just horrible pc performance. Once
> in
> a while I will get this error from the MS Update website: The website has
> encountered a problem and cannot display the page you are trying to view.
>
> I know I can just reimage the PC, but don't want to go there unless I have
> to. So far I have,
>
> 1. Run complete virus, adware, and spyware scans from regular mode and
> safe
> mode. Found none. Also ran a Macafee and Norton web scan just to be
> sure.
> Also found nothing.
> 2. Gone to the MS updates website and installed a few hotfixes which had
> to
> do with MS update and processor utiliization which have done nothing.
> 3. Manually updated the PC via the MS update website.
> 4. Turned off updates, rebooted, manually updated via the website,
> rebooted, re-enabled auto updates.
>
> Does anyone have any additonal advice to help me fix the issue besides
> reimaging the PC?

I experienced this problem recently on a computer that had been running
Windows Update and that I adjusted to run Microsoft Update. Although I read
the referneces given by "PA Bear" I'm still not too clear about the context.

Does the problem apply ONLY to computers running Microsoft Update?

Will it manifest rapidly or can computers appear to function normally for a
time before showing problems?

AlanB <> wrote:

> I experienced this problem recently on a computer that had been
> running Windows Update and that I adjusted to run Microsoft Update.
>
> Does the problem apply ONLY to computers running Microsoft Update?

Yes, but not all PCs running Microsoft Update. It is not yet understood why
a few PCs exhibit this problem when the vast majority are working normally.
I work in an organisation with very many PCs, and have yet to see a single
example of this problem.

It is suspected that the problem is more severe when Office 2003 is
installed. Other versions of Office do not seem to have produced as many
reports of this problem.

Windows Update does not cause this problem.

> Will it manifest rapidly or can computers appear to function normally
> for a time before showing problems?

We don't know. Some PCs were reporting this problem over a year ago. Some
have only just begun to exhibit the problem.

--
Robin Walker [MVP Networking]

"AlanB" <> schrieb:

> Does the problem apply ONLY to computers running Microsoft Update?

Yes - and with MS Office (esp. 2003) installed.

> Will it manifest rapidly or can computers appear to function normally for a
> time before showing problems?

The latter.

Bye,
Freudi

Hans-Georg Michna wrote:
> On Mon, 14 May 2007 09:58:01 -0700, Anthony wrote:
>
>> sorry....the code is actually 0x8DDD009
>
> Sure?
>
> Hans-Georg

I think he means 0x8DDD0009. I'm getting the same error.

Mike Meyer wrote:
> Hans-Georg Michna wrote:
>> On Mon, 14 May 2007 09:58:01 -0700, Anthony wrote:
>>
>>> sorry....the code is actually 0x8DDD009
>>
>> Sure?
>
> I think he means 0x8DDD0009. I'm getting the same error.

See
http://groups.google.com/group/micro...coring=d&hl=en

Fix, courtesy of MVP Emeritus Ottmar Freudenberger:

1. First install the newly released 'standalone' version of Windows Update
Agent 3.0, v7.0.6000.374
http://support.microsoft.com/kb/932494

Direct Download links:

x86-based versions of Windows (most users)
http://download.windowsupdate.com/v7...gent30-x86.exe

x64-based versions of Windows
http://download.windowsupdate.com/v7...gent30-x64.exe

Itanium-based versions of Windows
http://download.windowsupdate.com/v7...ent30-ia64.exe

2. Now (re)install this (updated) fix:
http://support.microsoft.com/kb/927891

3. Reboot.

The MS update team believes that this solves all three svchost problems that
folks have been experiencing. See
http://blogs.technet.com/wsus/archiv...follow-up.aspx
and http://blogs.technet.com/wsus/archiv...update-on.aspx

Also see
http://www.bleepingcomputer.com/blog...showentry=1071
(First try the steps posted May 4th at the beginning of the article.)

Workaround: Change the default from Microsoft Update to Windows Update: Go
to Microsoft Update > Click on Change Settings in left pane > Scroll to
bottom of page > To Stop Using Microsoft Update > Disable Microsoft Update
software and let me use Windows Update only (check). cf.
http://support.microsoft.com/kb/901037

With Windows Update as your default, you will need to check in at Office
Update to keep your Office applications fully patched:
http://office.microsoft.com/en-us/do...incatalog.aspx
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

Hans-Georg Michna wrote:

> On Tue, 15 May 2007 16:13:42 +0100, Robin Walker [MVP] wrote:
>
>
>>Yes, but not all PCs running Microsoft Update. It is not yet understood why
>>a few PCs exhibit this problem when the vast majority are working normally.
>>I work in an organisation with very many PCs, and have yet to see a single
>>example of this problem.
>>
>>It is suspected that the problem is more severe when Office 2003 is
>>installed. Other versions of Office do not seem to have produced as many
>>reports of this problem.
>
>
> Robin,
>
> I believe it is slower, single-core processors that experience
> the problem, because faster computers get through the process
> before the timeout.
>
> Hans-Georg

Not entirely so. There's an issue with the detection scan when it comes
to the DataStore.edb, located in WINDOWS\SoftwareDistribution\DataStore
My theory is that there's been data corruption in said file. I've also
seen said file grow to humongous proportions ... over 1 GB in some
situations.
As to what's caused it ... perhaps scanning or monitoring of the system
with an 'intrusive' AV [EX: Symantec 'products' aimed at Home Users]
and/or update sessions that may have been unexpectedly ended.

I don't think this issue can be tied soley to older, slower processors.
In fact, an ex-MVP contacted me about his brand new Vista system
experiencing this issue. It's far from 'under powered' and Office 2007
is installed.
We cleaned out the SoftwareDistribution subfolders and I suggested that
it not be scanned. The issue has not come back, yet.
Now I wish that I'd suggested deleting the DataStore.edb instead <w>

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

PA Bear wrote:
> http://download.windowsupdate.com/v7...gent30-x86.exe
> http://download.windowsupdate.com/v7...gent30-x64.exe
> http://download.windowsupdate.com/v7...ent30-ia64.exe
> http://support.microsoft.com/kb/927891
>
> The MS update team believes that this solves all three svchost problems
> that folks have been experiencing. See
> http://blogs.technet.com/wsus/archiv...follow-up.aspx
> and http://blogs.technet.com/wsus/archiv...update-on.aspx

Indeed, that fixed my issue.