Windows Update / Microsoft Update / svchost / Autoupdate / 100% CPU

We run a domain with about 500 PC's. We've been having a lot of
problems with svchost crashes or 100% CPU usage related to automatic
updates lately. We have done a lot of experimenting and poking around
on newsgroups, and seen many many different posted 'workarounds', etc

None of them seem to work 100%. We've boiled down the workarounds to a
script that looks like this:

net stop wuauserv
net stop BITS
move c:\windows\SoftwareDistribution c:\windows\SDOld
REGSVR32 /s WUAPI.DLL
REGSVR32 /s WUAUENG.DLL
REGSVR32 /s WUAUENG1.DLL
REGSVR32 /s ATL.DLL
REGSVR32 /s WUCLTUI.DLL
REGSVR32 /s WUPS.DLL
REGSVR32 /s WUPS2.DLL
REGSVR32 /s WUWEB.DLL
I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart

and then we manually restart.

And this works great... **As Long** as you don't resetup/reconfigure
Microsoft Update. As soon as you reenable it, wham, your right back
where you started with 100% CPU usage.

Microsoft Update finally came back with the results on my machine after
close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.

It's not a virus, malwar, spyware, etc. It is replicateable on
machines, vmware sessions, fresh builds, old machines, etc. We have
applied the KB927891 hotfix(read the script above) with no effect.

We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
default other applications and the effect seems to be widespread.

Windows Update works fine after the above script, but we would like to
be able to use Microsoft Update to keep Office, etc up to date. Does
anyone know if there is a fix for this out yet, in the works, anything?

If not does anybody know how to unregister Microsoft Update from a
command line, is it a DLL that can be unregistered? Going to the update
site to turn it off individually on 500 machines doesn't sound like fun.

Thanks,

Pat

Suggestions here:
http://www.windowsitpro.com/Article/...649/21649.html

- John

"Patrick Hopp" wrote:

> We run a domain with about 500 PC's. We've been having a lot of
> problems with svchost crashes or 100% CPU usage related to automatic
> updates lately. We have done a lot of experimenting and poking around
> on newsgroups, and seen many many different posted 'workarounds', etc
>
> None of them seem to work 100%. We've boiled down the workarounds to a
> script that looks like this:
>
> net stop wuauserv
> net stop BITS
> move c:\windows\SoftwareDistribution c:\windows\SDOld
> REGSVR32 /s WUAPI.DLL
> REGSVR32 /s WUAUENG.DLL
> REGSVR32 /s WUAUENG1.DLL
> REGSVR32 /s ATL.DLL
> REGSVR32 /s WUCLTUI.DLL
> REGSVR32 /s WUPS.DLL
> REGSVR32 /s WUPS2.DLL
> REGSVR32 /s WUWEB.DLL
> I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
>
> and then we manually restart.
>
> And this works great... **As Long** as you don't resetup/reconfigure
> Microsoft Update. As soon as you reenable it, wham, your right back
> where you started with 100% CPU usage.
>
> Microsoft Update finally came back with the results on my machine after
> close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.
>
> It's not a virus, malwar, spyware, etc. It is replicateable on
> machines, vmware sessions, fresh builds, old machines, etc. We have
> applied the KB927891 hotfix(read the script above) with no effect.
>
> We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
> default other applications and the effect seems to be widespread.
>
> Windows Update works fine after the above script, but we would like to
> be able to use Microsoft Update to keep Office, etc up to date. Does
> anyone know if there is a fix for this out yet, in the works, anything?
>
> If not does anybody know how to unregister Microsoft Update from a
> command line, is it a DLL that can be unregistered? Going to the update
> site to turn it off individually on 500 machines doesn't sound like fun.
>
> Thanks,
>
> Pat
>

Until a new version of MU is released, reset your default to Windows Update
and obtain Office updates via Office Update website.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

Patrick Hopp wrote:
> We run a domain with about 500 PC's. We've been having a lot of
> problems with svchost crashes or 100% CPU usage related to automatic
> updates lately. We have done a lot of experimenting and poking around
> on newsgroups, and seen many many different posted 'workarounds', etc
>
> None of them seem to work 100%. We've boiled down the workarounds to a
> script that looks like this:
>
> net stop wuauserv
> net stop BITS
> move c:\windows\SoftwareDistribution c:\windows\SDOld
> REGSVR32 /s WUAPI.DLL
> REGSVR32 /s WUAUENG.DLL
> REGSVR32 /s WUAUENG1.DLL
> REGSVR32 /s ATL.DLL
> REGSVR32 /s WUCLTUI.DLL
> REGSVR32 /s WUPS.DLL
> REGSVR32 /s WUPS2.DLL
> REGSVR32 /s WUWEB.DLL
> I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
>
> and then we manually restart.
>
> And this works great... **As Long** as you don't resetup/reconfigure
> Microsoft Update. As soon as you reenable it, wham, your right back
> where you started with 100% CPU usage.
>
> Microsoft Update finally came back with the results on my machine after
> close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.
>
> It's not a virus, malwar, spyware, etc. It is replicateable on
> machines, vmware sessions, fresh builds, old machines, etc. We have
> applied the KB927891 hotfix(read the script above) with no effect.
>
> We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
> default other applications and the effect seems to be widespread.
>
> Windows Update works fine after the above script, but we would like to
> be able to use Microsoft Update to keep Office, etc up to date. Does
> anyone know if there is a fix for this out yet, in the works, anything?
>
> If not does anybody know how to unregister Microsoft Update from a
> command line, is it a DLL that can be unregistered? Going to the update
> site to turn it off individually on 500 machines doesn't sound like fun.
>
> Thanks,
>
> Pat

Install this fix for now:
http://support.microsoft.com/kb/927891/

This fixes the crashes and improves performance for somewhat faster scans,
and improves the 100% CPU issue in some cases. Still working on the full
final solution.

This fix replaces kb/932494 and kb/916089 for a cumulative fix for all three
issues.



"PA Bear" <> wrote in message
news:%...
> Until a new version of MU is released, reset your default to Windows
> Update and obtain Office updates via Office Update website.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin; DTS-L.org
>
> Patrick Hopp wrote:
>> We run a domain with about 500 PC's. We've been having a lot of
>> problems with svchost crashes or 100% CPU usage related to automatic
>> updates lately. We have done a lot of experimenting and poking around
>> on newsgroups, and seen many many different posted 'workarounds', etc
>>
>> None of them seem to work 100%. We've boiled down the workarounds to a
>> script that looks like this:
>>
>> net stop wuauserv
>> net stop BITS
>> move c:\windows\SoftwareDistribution c:\windows\SDOld
>> REGSVR32 /s WUAPI.DLL
>> REGSVR32 /s WUAUENG.DLL
>> REGSVR32 /s WUAUENG1.DLL
>> REGSVR32 /s ATL.DLL
>> REGSVR32 /s WUCLTUI.DLL
>> REGSVR32 /s WUPS.DLL
>> REGSVR32 /s WUPS2.DLL
>> REGSVR32 /s WUWEB.DLL
>> I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
>>
>> and then we manually restart.
>>
>> And this works great... **As Long** as you don't resetup/reconfigure
>> Microsoft Update. As soon as you reenable it, wham, your right back
>> where you started with 100% CPU usage.
>>
>> Microsoft Update finally came back with the results on my machine after
>> close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.
>>
>> It's not a virus, malwar, spyware, etc. It is replicateable on
>> machines, vmware sessions, fresh builds, old machines, etc. We have
>> applied the KB927891 hotfix(read the script above) with no effect.
>>
>> We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
>> default other applications and the effect seems to be widespread.
>>
>> Windows Update works fine after the above script, but we would like to
>> be able to use Microsoft Update to keep Office, etc up to date. Does
>> anyone know if there is a fix for this out yet, in the works, anything?
>>
>> If not does anybody know how to unregister Microsoft Update from a
>> command line, is it a DLL that can be unregistered? Going to the update
>> site to turn it off individually on 500 machines doesn't sound like fun.
>>
>> Thanks,
>>
>> Pat
>

This what launches MU from the Start Menu, Patrick :

D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\muweb.dll,LaunchMUSite

Perhaps unregistering muweb.dll and reregistering wuweb.dll would do the
trick, although reregistering may not be need for the wu .dll.
I'm not totally convinced that this is correct though ... YMMV

On the other hand, why isn't WSUS being used to pull the updates down
and then push them out to the workstations ?


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============



Patrick Hopp wrote:

> We run a domain with about 500 PC's. We've been having a lot of
> problems with svchost crashes or 100% CPU usage related to automatic
> updates lately. We have done a lot of experimenting and poking around
> on newsgroups, and seen many many different posted 'workarounds', etc
>
> None of them seem to work 100%. We've boiled down the workarounds to a
> script that looks like this:
>
> net stop wuauserv
> net stop BITS
> move c:\windows\SoftwareDistribution c:\windows\SDOld
> REGSVR32 /s WUAPI.DLL
> REGSVR32 /s WUAUENG.DLL
> REGSVR32 /s WUAUENG1.DLL
> REGSVR32 /s ATL.DLL
> REGSVR32 /s WUCLTUI.DLL
> REGSVR32 /s WUPS.DLL
> REGSVR32 /s WUPS2.DLL
> REGSVR32 /s WUWEB.DLL
> I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
>
> and then we manually restart.
>
> And this works great... **As Long** as you don't resetup/reconfigure
> Microsoft Update. As soon as you reenable it, wham, your right back
> where you started with 100% CPU usage.
>
> Microsoft Update finally came back with the results on my machine after
> close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.
>
> It's not a virus, malwar, spyware, etc. It is replicateable on
> machines, vmware sessions, fresh builds, old machines, etc. We have
> applied the KB927891 hotfix(read the script above) with no effect.
>
> We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
> default other applications and the effect seems to be widespread.
>
> Windows Update works fine after the above script, but we would like to
> be able to use Microsoft Update to keep Office, etc up to date. Does
> anyone know if there is a fix for this out yet, in the works, anything?
>
> If not does anybody know how to unregister Microsoft Update from a
> command line, is it a DLL that can be unregistered? Going to the update
> site to turn it off individually on 500 machines doesn't sound like fun.
>
> Thanks,
>
> Pat

You may have missed...

> Patrick Hopp wrote:
>> ...We have
>> applied the KB927891 hotfix(read the script above) with no effect.
--
~PA Bear

John [MSFT] wrote:
> Install this fix for now:
> http://support.microsoft.com/kb/927891/
>
> This fixes the crashes and improves performance for somewhat faster scans,
> and improves the 100% CPU issue in some cases. Still working on the full
> final solution.
>
> This fix replaces kb/932494 and kb/916089 for a cumulative fix for all
> three
> issues.
>
>
>
> "PA Bear" <> wrote in message
> news:%...
>> Until a new version of MU is released, reset your default to Windows
>> Update and obtain Office updates via Office Update website.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-Windows (IE, OE, Security, Shell/User)
>> AumHa VSOP & Admin; DTS-L.org
>>
>> Patrick Hopp wrote:
>>> We run a domain with about 500 PC's. We've been having a lot of
>>> problems with svchost crashes or 100% CPU usage related to automatic
>>> updates lately. We have done a lot of experimenting and poking around
>>> on newsgroups, and seen many many different posted 'workarounds', etc
>>>
>>> None of them seem to work 100%. We've boiled down the workarounds to a
>>> script that looks like this:
>>>
>>> net stop wuauserv
>>> net stop BITS
>>> move c:\windows\SoftwareDistribution c:\windows\SDOld
>>> REGSVR32 /s WUAPI.DLL
>>> REGSVR32 /s WUAUENG.DLL
>>> REGSVR32 /s WUAUENG1.DLL
>>> REGSVR32 /s ATL.DLL
>>> REGSVR32 /s WUCLTUI.DLL
>>> REGSVR32 /s WUPS.DLL
>>> REGSVR32 /s WUPS2.DLL
>>> REGSVR32 /s WUWEB.DLL
>>> I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
>>>
>>> and then we manually restart.
>>>
>>> And this works great... **As Long** as you don't resetup/reconfigure
>>> Microsoft Update. As soon as you reenable it, wham, your right back
>>> where you started with 100% CPU usage.
>>>
>>> Microsoft Update finally came back with the results on my machine after
>>> close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.
>>>
>>> It's not a virus, malwar, spyware, etc. It is replicateable on
>>> machines, vmware sessions, fresh builds, old machines, etc. We have
>>> applied the KB927891 hotfix(read the script above) with no effect.
>>>
>>> We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
>>> default other applications and the effect seems to be widespread.
>>>
>>> Windows Update works fine after the above script, but we would like to
>>> be able to use Microsoft Update to keep Office, etc up to date. Does
>>> anyone know if there is a fix for this out yet, in the works, anything?
>>>
>>> If not does anybody know how to unregister Microsoft Update from a
>>> command line, is it a DLL that can be unregistered? Going to the update
>>> site to turn it off individually on 500 machines doesn't sound like fun.
>>>
>>> Thanks,
>>>
>>> Pat

Yep, sorry. This fixes all the known crashes and does some perf
improvements.

There is a corresponding fix "coming soon" in another component that will
fix the "hung UI" issue. It's not the 100% CPU that is the underlying
problem, it is that the UI threads get blocked and the system appears to
hang.


"PA Bear" <> wrote in message
news:...
> You may have missed...
>
>> Patrick Hopp wrote:
>>> ...We have
>>> applied the KB927891 hotfix(read the script above) with no effect.
> --
> ~PA Bear
>
> John [MSFT] wrote:
>> Install this fix for now:
>> http://support.microsoft.com/kb/927891/
>>
>> This fixes the crashes and improves performance for somewhat faster
>> scans,
>> and improves the 100% CPU issue in some cases. Still working on the full
>> final solution.
>>
>> This fix replaces kb/932494 and kb/916089 for a cumulative fix for all
>> three
>> issues.
>>
>>
>>
>> "PA Bear" <> wrote in message
>> news:%...
>>> Until a new version of MU is released, reset your default to Windows
>>> Update and obtain Office updates via Office Update website.
>>> --
>>> ~Robear Dyer (PA Bear)
>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>> AumHa VSOP & Admin; DTS-L.org
>>>
>>> Patrick Hopp wrote:
>>>> We run a domain with about 500 PC's. We've been having a lot of
>>>> problems with svchost crashes or 100% CPU usage related to automatic
>>>> updates lately. We have done a lot of experimenting and poking around
>>>> on newsgroups, and seen many many different posted 'workarounds', etc
>>>>
>>>> None of them seem to work 100%. We've boiled down the workarounds to a
>>>> script that looks like this:
>>>>
>>>> net stop wuauserv
>>>> net stop BITS
>>>> move c:\windows\SoftwareDistribution c:\windows\SDOld
>>>> REGSVR32 /s WUAPI.DLL
>>>> REGSVR32 /s WUAUENG.DLL
>>>> REGSVR32 /s WUAUENG1.DLL
>>>> REGSVR32 /s ATL.DLL
>>>> REGSVR32 /s WUCLTUI.DLL
>>>> REGSVR32 /s WUPS.DLL
>>>> REGSVR32 /s WUPS2.DLL
>>>> REGSVR32 /s WUWEB.DLL
>>>> I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
>>>>
>>>> and then we manually restart.
>>>>
>>>> And this works great... **As Long** as you don't resetup/reconfigure
>>>> Microsoft Update. As soon as you reenable it, wham, your right back
>>>> where you started with 100% CPU usage.
>>>>
>>>> Microsoft Update finally came back with the results on my machine after
>>>> close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.
>>>>
>>>> It's not a virus, malwar, spyware, etc. It is replicateable on
>>>> machines, vmware sessions, fresh builds, old machines, etc. We have
>>>> applied the KB927891 hotfix(read the script above) with no effect.
>>>>
>>>> We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host
>>>> of
>>>> default other applications and the effect seems to be widespread.
>>>>
>>>> Windows Update works fine after the above script, but we would like to
>>>> be able to use Microsoft Update to keep Office, etc up to date. Does
>>>> anyone know if there is a fix for this out yet, in the works, anything?
>>>>
>>>> If not does anybody know how to unregister Microsoft Update from a
>>>> command line, is it a DLL that can be unregistered? Going to the
>>>> update
>>>> site to turn it off individually on 500 machines doesn't sound like
>>>> fun.
>>>>
>>>> Thanks,
>>>>
>>>> Pat
>

I've got a WSUS server here and several boxes experience the 99% CPU usage
problem. I had to disable the WSUS box via group policy. Still waiting on a
fix here.

"MowGreen [MVP]" wrote:

> This what launches MU from the Start Menu, Patrick :
>
> D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\muweb.dll,LaunchMUSite
>
> Perhaps unregistering muweb.dll and reregistering wuweb.dll would do the
> trick, although reregistering may not be need for the wu .dll.
> I'm not totally convinced that this is correct though ... YMMV
>
> On the other hand, why isn't WSUS being used to pull the updates down
> and then push them out to the workstations ?
>
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> Patrick Hopp wrote:
>
> > We run a domain with about 500 PC's. We've been having a lot of
> > problems with svchost crashes or 100% CPU usage related to automatic
> > updates lately. We have done a lot of experimenting and poking around
> > on newsgroups, and seen many many different posted 'workarounds', etc
> >
> > None of them seem to work 100%. We've boiled down the workarounds to a
> > script that looks like this:
> >
> > net stop wuauserv
> > net stop BITS
> > move c:\windows\SoftwareDistribution c:\windows\SDOld
> > REGSVR32 /s WUAPI.DLL
> > REGSVR32 /s WUAUENG.DLL
> > REGSVR32 /s WUAUENG1.DLL
> > REGSVR32 /s ATL.DLL
> > REGSVR32 /s WUCLTUI.DLL
> > REGSVR32 /s WUPS.DLL
> > REGSVR32 /s WUPS2.DLL
> > REGSVR32 /s WUWEB.DLL
> > I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
> >
> > and then we manually restart.
> >
> > And this works great... **As Long** as you don't resetup/reconfigure
> > Microsoft Update. As soon as you reenable it, wham, your right back
> > where you started with 100% CPU usage.
> >
> > Microsoft Update finally came back with the results on my machine after
> > close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.
> >
> > It's not a virus, malwar, spyware, etc. It is replicateable on
> > machines, vmware sessions, fresh builds, old machines, etc. We have
> > applied the KB927891 hotfix(read the script above) with no effect.
> >
> > We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
> > default other applications and the effect seems to be widespread.
> >
> > Windows Update works fine after the above script, but we would like to
> > be able to use Microsoft Update to keep Office, etc up to date. Does
> > anyone know if there is a fix for this out yet, in the works, anything?
> >
> > If not does anybody know how to unregister Microsoft Update from a
> > command line, is it a DLL that can be unregistered? Going to the update
> > site to turn it off individually on 500 machines doesn't sound like fun.
> >
> > Thanks,
> >
> > Pat
>