Windows Update 100% CPU usage issue - a NEW twist on an old proble

Posting this hoping that someone in the WIndows Update team is aware of and
looking at this problem. I am 100% sure there is a new issue with
servicehost.exe process taking 100% CPU. The bahavior is similar but
actually worse than the problem of a year or so ago that was patched. This
is a NEW issue.

Since Tuesday a significant number of our customers (most are fully up to
date XP SP2, all flavors) are having issues with Windows update taking 100%
of CPU. On a single processor system the PC goes to 100% CPU and never
clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
core CPU one thread runs the one cpu to 100% but the remainder of the PC is
stable. A work-around is disabling auto-update.

We have had 2 Vista systems showing similar behavior but not to the same
scale as XP BTW so something is clearly in need of review.

It does not appear to be SP3 itself, nor does it appear to be a latency/load
issue on the WU servers. The PCs we have had this on are all different OEMs,
different ISPs, different sites etc. the common thread is this one service
that gets stuck and never clears, unlike the similar issue a year ago that
would eventually clear.

MSFT, please get on top of this before it snowballs.

Asker of stupid questions wrote:
> Posting this hoping that someone in the WIndows Update team is
> aware of and looking at this problem. I am 100% sure there is a
> new issue with servicehost.exe process taking 100% CPU. The
> bahavior is similar but actually worse than the problem of a year
> or so ago that was patched. This is a NEW issue.
>
> Since Tuesday a significant number of our customers (most are fully
> up to date XP SP2, all flavors) are having issues with Windows
> update taking 100% of CPU. On a single processor system the PC
> goes to 100% CPU and never clears, we have left 2 systems over 5+
> hours. On a hyper threaded or dual core CPU one thread runs the
> one cpu to 100% but the remainder of the PC is stable. A
> work-around is disabling auto-update.
>
> We have had 2 Vista systems showing similar behavior but not to the
> same scale as XP BTW so something is clearly in need of review.
>
> It does not appear to be SP3 itself, nor does it appear to be a
> latency/load issue on the WU servers. The PCs we have had this on
> are all different OEMs, different ISPs, different sites etc. the
> common thread is this one service that gets stuck and never clears,
> unlike the similar issue a year ago that would eventually clear.
>
> MSFT, please get on top of this before it snowballs.

One question - you stated, "most are fully up to date XP SP2, all flavors"
then state, "It does not appear to be SP3 itself" <- do you mean it does not
appear to be the attempted installation of SP3?

I have not seen this issue on the few hundred I have running SP2+ all
updates right before SP3 nor on the couple of hundred running SP3 - so...
There must be more to this.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

FYI - These PCs are not in a managed environment, these are all stand alone,
a mix of pro and home.
The issue appears not to be the download of SP3 itself. It happens at the
initial review of WU on the PC when WU is deciding what needs to be done
with/to the PC.
PCs are at SP2 when they get stuck, we have had a couple that sp3 install
"fixed" the issue but most are not getting that far, and some post SP3
install are still getting stuck in the same way.

it is random, in terms of who gets impacted but the impacted behavior is
consistant.

"Shenan Stanley" wrote:

> Asker of stupid questions wrote:
> > Posting this hoping that someone in the WIndows Update team is
> > aware of and looking at this problem. I am 100% sure there is a
> > new issue with servicehost.exe process taking 100% CPU. The
> > bahavior is similar but actually worse than the problem of a year
> > or so ago that was patched. This is a NEW issue.
> >
> > Since Tuesday a significant number of our customers (most are fully
> > up to date XP SP2, all flavors) are having issues with Windows
> > update taking 100% of CPU. On a single processor system the PC
> > goes to 100% CPU and never clears, we have left 2 systems over 5+
> > hours. On a hyper threaded or dual core CPU one thread runs the
> > one cpu to 100% but the remainder of the PC is stable. A
> > work-around is disabling auto-update.
> >
> > We have had 2 Vista systems showing similar behavior but not to the
> > same scale as XP BTW so something is clearly in need of review.
> >
> > It does not appear to be SP3 itself, nor does it appear to be a
> > latency/load issue on the WU servers. The PCs we have had this on
> > are all different OEMs, different ISPs, different sites etc. the
> > common thread is this one service that gets stuck and never clears,
> > unlike the similar issue a year ago that would eventually clear.
> >
> > MSFT, please get on top of this before it snowballs.
>
> One question - you stated, "most are fully up to date XP SP2, all flavors"
> then state, "It does not appear to be SP3 itself" <- do you mean it does not
> appear to be the attempted installation of SP3?
>
> I have not seen this issue on the few hundred I have running SP2+ all
> updates right before SP3 nor on the couple of hundred running SP3 - so...
> There must be more to this.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Are the machines updating via WSUS?

Are all machines running Windows Update Agent 3.0, v7.0.6000.381?

Is KB927891 installed on all WinXP SP2 machines?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.net


Asker of stupid questions wrote:
> FYI - These PCs are not in a managed environment, these are all stand
> alone,
> a mix of pro and home.
> The issue appears not to be the download of SP3 itself. It happens at the
> initial review of WU on the PC when WU is deciding what needs to be done
> with/to the PC.
> PCs are at SP2 when they get stuck, we have had a couple that sp3 install
> "fixed" the issue but most are not getting that far, and some post SP3
> install are still getting stuck in the same way.
>
> it is random, in terms of who gets impacted but the impacted behavior is
> consistant.
>
> "Shenan Stanley" wrote:
>
>> Asker of stupid questions wrote:
>>> Posting this hoping that someone in the WIndows Update team is
>>> aware of and looking at this problem. I am 100% sure there is a
>>> new issue with servicehost.exe process taking 100% CPU. The
>>> bahavior is similar but actually worse than the problem of a year
>>> or so ago that was patched. This is a NEW issue.
>>>
>>> Since Tuesday a significant number of our customers (most are fully
>>> up to date XP SP2, all flavors) are having issues with Windows
>>> update taking 100% of CPU. On a single processor system the PC
>>> goes to 100% CPU and never clears, we have left 2 systems over 5+
>>> hours. On a hyper threaded or dual core CPU one thread runs the
>>> one cpu to 100% but the remainder of the PC is stable. A
>>> work-around is disabling auto-update.
>>>
>>> We have had 2 Vista systems showing similar behavior but not to the
>>> same scale as XP BTW so something is clearly in need of review.
>>>
>>> It does not appear to be SP3 itself, nor does it appear to be a
>>> latency/load issue on the WU servers. The PCs we have had this on
>>> are all different OEMs, different ISPs, different sites etc. the
>>> common thread is this one service that gets stuck and never clears,
>>> unlike the similar issue a year ago that would eventually clear.
>>>
>>> MSFT, please get on top of this before it snowballs.
>>
>> One question - you stated, "most are fully up to date XP SP2, all
>> flavors"
>> then state, "It does not appear to be SP3 itself" <- do you mean it does
>> not appear to be the attempted installation of SP3?
>>
>> I have not seen this issue on the few hundred I have running SP2+ all
>> updates right before SP3 nor on the couple of hundred running SP3 - so...
>> There must be more to this.
>>
>> --
>> Shenan Stanley
>> MS-MVP
>> --
>> How To Ask Questions The Smart Way
>> http://www.catb.org/~esr/faqs/smart-questions.html

I just had this same problem yesterday with an attempted update and sent a
request for help to support. My computer is not on a network and has XP home
edition with SP2. (I don't think that it has done an automatic update to
SP3.) Yesterday the update scan of my system was taking longer than usual
and since I had to leave I ended up shutting everything down before it was
done. The shut-down took longer than usual. The next time that I booted up
the entire system bogged down and the CPU was running at almost 100% on
something. It would take it almost 5 minutes to respond to a single mouse
click. I ended up restoring the system to some settings from about a month
ago and turned off the automatic update. I will carefully follow the
postings here and hope to hear back on my question from an MS tech within 24
hours.

"PA Bear [MS MVP]" wrote:

> Are the machines updating via WSUS?
>
> Are all machines running Windows Update Agent 3.0, v7.0.6000.381?
>
> Is KB927891 installed on all WinXP SP2 machines?
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin; DTS-L.net
>
>
> Asker of stupid questions wrote:
> > FYI - These PCs are not in a managed environment, these are all stand
> > alone,
> > a mix of pro and home.
> > The issue appears not to be the download of SP3 itself. It happens at the
> > initial review of WU on the PC when WU is deciding what needs to be done
> > with/to the PC.
> > PCs are at SP2 when they get stuck, we have had a couple that sp3 install
> > "fixed" the issue but most are not getting that far, and some post SP3
> > install are still getting stuck in the same way.
> >
> > it is random, in terms of who gets impacted but the impacted behavior is
> > consistant.
> >
> > "Shenan Stanley" wrote:
> >
> >> Asker of stupid questions wrote:
> >>> Posting this hoping that someone in the WIndows Update team is
> >>> aware of and looking at this problem. I am 100% sure there is a
> >>> new issue with servicehost.exe process taking 100% CPU. The
> >>> bahavior is similar but actually worse than the problem of a year
> >>> or so ago that was patched. This is a NEW issue.
> >>>
> >>> Since Tuesday a significant number of our customers (most are fully
> >>> up to date XP SP2, all flavors) are having issues with Windows
> >>> update taking 100% of CPU. On a single processor system the PC
> >>> goes to 100% CPU and never clears, we have left 2 systems over 5+
> >>> hours. On a hyper threaded or dual core CPU one thread runs the
> >>> one cpu to 100% but the remainder of the PC is stable. A
> >>> work-around is disabling auto-update.
> >>>
> >>> We have had 2 Vista systems showing similar behavior but not to the
> >>> same scale as XP BTW so something is clearly in need of review.
> >>>
> >>> It does not appear to be SP3 itself, nor does it appear to be a
> >>> latency/load issue on the WU servers. The PCs we have had this on
> >>> are all different OEMs, different ISPs, different sites etc. the
> >>> common thread is this one service that gets stuck and never clears,
> >>> unlike the similar issue a year ago that would eventually clear.
> >>>
> >>> MSFT, please get on top of this before it snowballs.
> >>
> >> One question - you stated, "most are fully up to date XP SP2, all
> >> flavors"
> >> then state, "It does not appear to be SP3 itself" <- do you mean it does
> >> not appear to be the attempted installation of SP3?
> >>
> >> I have not seen this issue on the few hundred I have running SP2+ all
> >> updates right before SP3 nor on the couple of hundred running SP3 - so...
> >> There must be more to this.
> >>
> >> --
> >> Shenan Stanley
> >> MS-MVP
> >> --
> >> How To Ask Questions The Smart Way
> >> http://www.catb.org/~esr/faqs/smart-questions.html
>
>

This started happening to my XP Home SP2 notebook last week. It's not on a
domain (although I have a small home-network). Basically, an instance of
SVCHOST.EXE would run up to 100% about 30-60 seconds after getting to my
desktop and it would start consuming memory until it hit > 100MB.

Ending the offending SVCHOST process disabled audio and networking.
Restarting the effected services does not fix the problem.

So basically my notebook was unusable.

Some forums posts from back in 2006 and 2007 pointed to Automatic Updates. I
install updates regularly (as they are available).

Using Process Explorer, I confirmed that Automatic Updates is the problem
and I disabled it using MSCONFIG. My CPU is now idling.

So some update that Microsoft recently pushed out is likely the cause of the
problem. I'm going to keep watching but for right now I am not going to
re-enable automatic updates.

Please begin a new thread about your problem.

shayward wrote:
> This started happening to my XP Home SP2 notebook last week. It's not on a
> domain (although I have a small home-network). Basically, an instance of
> SVCHOST.EXE would run up to 100% about 30-60 seconds after getting to my
> desktop and it would start consuming memory until it hit > 100MB.
>
> Ending the offending SVCHOST process disabled audio and networking.
> Restarting the effected services does not fix the problem.
>
> So basically my notebook was unusable.
>
> Some forums posts from back in 2006 and 2007 pointed to Automatic Updates.
> I
> install updates regularly (as they are available).
>
> Using Process Explorer, I confirmed that Automatic Updates is the problem
> and I disabled it using MSCONFIG. My CPU is now idling.
>
> So some update that Microsoft recently pushed out is likely the cause of
> the
> problem. I'm going to keep watching but for right now I am not going to
> re-enable automatic updates.

Very interesting and agree this is a new issue. My issues start about the
same time when XP SP3 auto update showed up. The auto update never finished
and resulted in the 100% of svchost.exe (windows update). Searched the web
for fixes and got suggestion, but none work so far. And everytime I go to
windows update site and run the check, with 30-60 seconds, my CPM maxes out.

So what is the fix for this issue?
Ron D.

"Asker of stupid questions" wrote:

> Posting this hoping that someone in the WIndows Update team is aware of and
> looking at this problem. I am 100% sure there is a new issue with
> servicehost.exe process taking 100% CPU. The bahavior is similar but
> actually worse than the problem of a year or so ago that was patched. This
> is a NEW issue.
>
> Since Tuesday a significant number of our customers (most are fully up to
> date XP SP2, all flavors) are having issues with Windows update taking 100%
> of CPU. On a single processor system the PC goes to 100% CPU and never
> clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
> core CPU one thread runs the one cpu to 100% but the remainder of the PC is
> stable. A work-around is disabling auto-update.
>
> We have had 2 Vista systems showing similar behavior but not to the same
> scale as XP BTW so something is clearly in need of review.
>
> It does not appear to be SP3 itself, nor does it appear to be a latency/load
> issue on the WU servers. The PCs we have had this on are all different OEMs,
> different ISPs, different sites etc. the common thread is this one service
> that gets stuck and never clears, unlike the similar issue a year ago that
> would eventually clear.
>
> MSFT, please get on top of this before it snowballs.

CA Antivirus has been identified as one of the causes of the CPU
utilization issue. It was either an updated DAT or engine update that
causes this. Configure CA to not scan .msi and .msp files for now and
hope that CA issues a less troublesome DAT/engine update:

http://forums.microsoft.com/technet/...&tf=0&pageid=1

> Have just got off talking to a CA technician. Was advised to exclude all *.msp and *.msi files in
the Real-Time scan.
>
> What I did was:
>
> 1. "Open Security Center"
>
> 2. "Open Advance Settings"
>
> 3. Clicked on the "Options" button
>
> 4. Clicked on the "Modify" link under the Exclusions list and then "Added" *.msi and *.msp to the
> list and clicked OK

For other systems where SP3 has been applied and the issue is occurring
without CA being present, suggest downloading and installing the latest
Version of the Windows Update Agent.

Links to the WUA and instructions on installing it can be viewed here:
http://www.bleepingcomputer.com/blog...showentry=1172


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Ron D. wrote:

> Very interesting and agree this is a new issue. My issues start about the
> same time when XP SP3 auto update showed up. The auto update never finished
> and resulted in the 100% of svchost.exe (windows update). Searched the web
> for fixes and got suggestion, but none work so far. And everytime I go to
> windows update site and run the check, with 30-60 seconds, my CPM maxes out.
>
> So what is the fix for this issue?
> Ron D.
>
> "Asker of stupid questions" wrote:
>
>
>>Posting this hoping that someone in the WIndows Update team is aware of and
>>looking at this problem. I am 100% sure there is a new issue with
>>servicehost.exe process taking 100% CPU. The bahavior is similar but
>>actually worse than the problem of a year or so ago that was patched. This
>>is a NEW issue.
>>
>>Since Tuesday a significant number of our customers (most are fully up to
>>date XP SP2, all flavors) are having issues with Windows update taking 100%
>>of CPU. On a single processor system the PC goes to 100% CPU and never
>>clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
>>core CPU one thread runs the one cpu to 100% but the remainder of the PC is
>>stable. A work-around is disabling auto-update.
>>
>>We have had 2 Vista systems showing similar behavior but not to the same
>>scale as XP BTW so something is clearly in need of review.
>>
>>It does not appear to be SP3 itself, nor does it appear to be a latency/load
>>issue on the WU servers. The PCs we have had this on are all different OEMs,
>>different ISPs, different sites etc. the common thread is this one service
>>that gets stuck and never clears, unlike the similar issue a year ago that
>>would eventually clear.
>>
>>MSFT, please get on top of this before it snowballs.

I recently did a fresh reinstall of Win XP Pro with SP3
And I noticed the same 100% CPU utilization in svchost (Automatic Updates)
for 1~2 minutes every now and then.
I use Avira AntiVir Personal & Spybot's TeaTimer - any known interactions
with WU ?
I can try disabling Teatimer, but I would like to avoid removing Avira
(and/or replacing it with another AV).

Thanks

"MowGreen [MVP]" wrote:

> CA Antivirus has been identified as one of the causes of the CPU
> utilization issue. It was either an updated DAT or engine update that
> causes this. Configure CA to not scan .msi and .msp files for now and
> hope that CA issues a less troublesome DAT/engine update:
>
> http://forums.microsoft.com/technet/...&tf=0&pageid=1
>
> > Have just got off talking to a CA technician. Was advised to exclude all *.msp and *.msi files in
> the Real-Time scan.
> >
> > What I did was:
> >
> > 1. "Open Security Center"
> >
> > 2. "Open Advance Settings"
> >
> > 3. Clicked on the "Options" button
> >
> > 4. Clicked on the "Modify" link under the Exclusions list and then "Added" *.msi and *.msp to the
> > list and clicked OK
>
> For other systems where SP3 has been applied and the issue is occurring
> without CA being present, suggest downloading and installing the latest
> Version of the Windows Update Agent.
>
> Links to the WUA and instructions on installing it can be viewed here:
> http://www.bleepingcomputer.com/blog...showentry=1172
>
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> Ron D. wrote:
>
> > Very interesting and agree this is a new issue. My issues start about the
> > same time when XP SP3 auto update showed up. The auto update never finished
> > and resulted in the 100% of svchost.exe (windows update). Searched the web
> > for fixes and got suggestion, but none work so far. And everytime I go to
> > windows update site and run the check, with 30-60 seconds, my CPM maxes out.
> >
> > So what is the fix for this issue?
> > Ron D.
> >
> > "Asker of stupid questions" wrote:
> >
> >
> >>Posting this hoping that someone in the WIndows Update team is aware of and
> >>looking at this problem. I am 100% sure there is a new issue with
> >>servicehost.exe process taking 100% CPU. The bahavior is similar but
> >>actually worse than the problem of a year or so ago that was patched. This
> >>is a NEW issue.
> >>
> >>Since Tuesday a significant number of our customers (most are fully up to
> >>date XP SP2, all flavors) are having issues with Windows update taking 100%
> >>of CPU. On a single processor system the PC goes to 100% CPU and never
> >>clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
> >>core CPU one thread runs the one cpu to 100% but the remainder of the PC is
> >>stable. A work-around is disabling auto-update.
> >>
> >>We have had 2 Vista systems showing similar behavior but not to the same
> >>scale as XP BTW so something is clearly in need of review.
> >>
> >>It does not appear to be SP3 itself, nor does it appear to be a latency/load
> >>issue on the WU servers. The PCs we have had this on are all different OEMs,
> >>different ISPs, different sites etc. the common thread is this one service
> >>that gets stuck and never clears, unlike the similar issue a year ago that
> >>would eventually clear.
> >>
> >>MSFT, please get on top of this before it snowballs.
>