Windows Update, SVCHOST, and 99% CPU usage... help please...

Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
wmiprvse.exe starts.
My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
time it happens. If I bootup later in the day, all's cool... only happens first bootup of
the day.
If I disable WU, all is cool.

The only connections that open are to windows update, during this lag.
As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.

I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
returned error: 4200."
In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
0x80041002."

Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
do nothing, then I have no problems.

I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
Right now, I have WU disabled, but I'd prefer to be notified when

Anyone have any idea what might be going on, or where I can look on my system to
troubleshoot this? Anywhere I can find out what is using SVCHOST?
Any help is appreciated... thanks!

On Thu, 02 Mar 2006 15:44:57 +0000, Tiny Tim <_> wrote:

>On Thu, 02 Mar 2006 13:13:39 GMT, buRford <>
>wrote:
>
>>Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
>>the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
>>wmiprvse.exe starts.
>>My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
>>99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
>>time it happens. If I bootup later in the day, all's cool... only happens first bootup of
>>the day.
>>If I disable WU, all is cool.
>>
>>The only connections that open are to windows update, during this lag.
>>As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
>>plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.
>>
>>I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
>>returned error: 4200."
>>In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
>>0x80041002."
>>
>>Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
>>No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
>>do nothing, then I have no problems.
>>
>>I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
>>Right now, I have WU disabled, but I'd prefer to be notified when
>>
>>Anyone have any idea what might be going on, or where I can look on my system to
>>troubleshoot this? Anywhere I can find out what is using SVCHOST?
>>Any help is appreciated... thanks!
>
>You've isolated the problem - it's Microsoft Update. You should try
>suffering that amazing piece of engineering o on a PII 300 laptop. It
>takes several minutes to get through that 100% CPU stage on my poor
>old lappy.
>
>I also see that once the CPU calms down the SVCHOST process using all
>the CPU has accomplished 9.2GB of I/O as well. That's certainly going
>some on a system with a 4GB hard drive and only 3GB in use. What the
>hell is all that I/O about and where is it I/Oing to and from? It's
>not all disk activity and the network traffic is relatively light too
>so what is going on?
>
>It's hard to comprehend how MS could have created such a resource hog
>but no doubt an MVP will be along soon to enlighten us to the wisdom
>behind this.
>

Thing is, for me, this just started in the past month.
I used to be able to start working, as soon as the boot completed.
Now, I basically have to wait for 3-5 minutes.

As for an MVP coming along... over the past few days, I posted a similar question in
another NG... no responses. Strange, because you'd think they'd know something about
this.
The strange thing, is that it doesn't happen on every boot. Only when wmiprvse opens.
If I kill wmiprvse, it still hangs. The only thing that works is just disabling WU.

So, for now, I've just disabled WU. I just have to remember, every few days, to go to MS
Update... a bit of a pain, but hey...

For two weeks I have been experiencing the same CPU overload that Tiny Tim
and buFord have related to, it just dawned on me that it started when I
downloaded the "Microsoft Update" feature in lieu of 'Windows Update' site !
After all systems were booted up and stable [NAV, Zone Alarm, etc.] I have
had to wait as long as 4 minutes while SVCHost.exe robbed the CPU running at
70 to 75% usage all the while no other access was possible as total CPU Usage
was always 100% while SCVHost was running. Disabled the Microsoft/Windows
Update feature alltogether and success, I now have my PC back running the way
it used to ! ...NOW, is somebody going to wake up on the west coast out there
and fix this problem, or, shall we all just run our systems without knowing
if we are up todate with the latest patches, etc. ?? .........cheers;
McDoogie

"buRford" wrote:

> Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
> the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
> wmiprvse.exe starts.
> My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
> 99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
> time it happens. If I bootup later in the day, all's cool... only happens first bootup of
> the day.
> If I disable WU, all is cool.
>
> The only connections that open are to windows update, during this lag.
> As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
> plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.
>
> I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
> returned error: 4200."
> In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
> 0x80041002."
>
> Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
> No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
> do nothing, then I have no problems.
>
> I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
> Right now, I have WU disabled, but I'd prefer to be notified when
>
> Anyone have any idea what might be going on, or where I can look on my system to
> troubleshoot this? Anywhere I can find out what is using SVCHOST?
> Any help is appreciated... thanks!
>

Evening Folks:..Just noticed something of interest in the 'MIcrosoft Update'
site, one can now go in and "Change Settings", which allows one to just scan
and get updates for Windows [the old way !] and forget about updates for all
the other Microsoft Software programs, which require updates much less
frequently, this will free up a pile of CPU usage at Boot as each and every
time one' boot's up', you'll only be checking for Windows patches not the
whole shooting match....Have to check off the change however if one wants to
go this way !! McDoogie

"NeoX2K5" wrote:

> Hey BuRford,
>
> i had the same problem just 1 hour ago, but i think i've found the reason now.
> At first i had disabled all network-devices and tried a lot to solve the
> problem, but nothing brought the excepted result.
>
> You wrote that you have checked your PC with NOD32 ... just try to uninstall
> it.
> Don't know why, but it works (on my PC) ...
>
> "McDoogie" wrote:
>
> > For two weeks I have been experiencing the same CPU overload that Tiny Tim
> > and buFord have related to, it just dawned on me that it started when I
> > downloaded the "Microsoft Update" feature in lieu of 'Windows Update' site !
> > After all systems were booted up and stable [NAV, Zone Alarm, etc.] I have
> > had to wait as long as 4 minutes while SVCHost.exe robbed the CPU running at
> > 70 to 75% usage all the while no other access was possible as total CPU Usage
> > was always 100% while SCVHost was running. Disabled the Microsoft/Windows
> > Update feature alltogether and success, I now have my PC back running the way
> > it used to ! ...NOW, is somebody going to wake up on the west coast out there
> > and fix this problem, or, shall we all just run our systems without knowing
> > if we are up todate with the latest patches, etc. ?? .........cheers;
> > McDoogie
> >
> > "buRford" wrote:
> >
> > > Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
> > > the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
> > > wmiprvse.exe starts.
> > > My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
> > > 99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
> > > time it happens. If I bootup later in the day, all's cool... only happens first bootup of
> > > the day.
> > > If I disable WU, all is cool.
> > >
> > > The only connections that open are to windows update, during this lag.
> > > As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
> > > plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.
> > >
> > > I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
> > > returned error: 4200."
> > > In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
> > > 0x80041002."
> > >
> > > Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
> > > No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
> > > do nothing, then I have no problems.
> > >
> > > I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
> > > Right now, I have WU disabled, but I'd prefer to be notified when
> > >
> > > Anyone have any idea what might be going on, or where I can look on my system to
> > > troubleshoot this? Anywhere I can find out what is using SVCHOST?
> > > Any help is appreciated... thanks!
> > >

But here's the thing, an MVP has not come along and explained this. So
my thoughts would conclude that the great evil empire is doing
something behind our backs. Hum maybe like forcing windows genuine
advantage on us?

The further we go the more I think that computers as we know them are
doomed. MS is mostly crap. And most linuxes are following in their
footsteps. Yea for MAC...

Kirk
BTW. I am a hardcore windows admin.

McDoogie wrote:
> Evening Folks:..Just noticed something of interest in the 'MIcrosoft Update'
> site, one can now go in and "Change Settings", which allows one to just scan
> and get updates for Windows [the old way !] and forget about updates for all
> the other Microsoft Software programs, which require updates much less
> frequently, this will free up a pile of CPU usage at Boot as each and every
> time one' boot's up', you'll only be checking for Windows patches not the
> whole shooting match....Have to check off the change however if one wants to
> go this way !! McDoogie
>
> "NeoX2K5" wrote:
>
> > Hey BuRford,
> >
> > i had the same problem just 1 hour ago, but i think i've found the reason now.
> > At first i had disabled all network-devices and tried a lot to solve the
> > problem, but nothing brought the excepted result.
> >
> > You wrote that you have checked your PC with NOD32 ... just try to uninstall
> > it.
> > Don't know why, but it works (on my PC) ...
> >
> > "McDoogie" wrote:
> >
> > > For two weeks I have been experiencing the same CPU overload that Tiny Tim
> > > and buFord have related to, it just dawned on me that it started when I
> > > downloaded the "Microsoft Update" feature in lieu of 'Windows Update' site !
> > > After all systems were booted up and stable [NAV, Zone Alarm, etc.] I have
> > > had to wait as long as 4 minutes while SVCHost.exe robbed the CPU running at
> > > 70 to 75% usage all the while no other access was possible as total CPU Usage
> > > was always 100% while SCVHost was running. Disabled the Microsoft/Windows
> > > Update feature alltogether and success, I now have my PC back running the way
> > > it used to ! ...NOW, is somebody going to wake up on the west coast out there
> > > and fix this problem, or, shall we all just run our systems without knowing
> > > if we are up todate with the latest patches, etc. ?? .........cheers;
> > > McDoogie
> > >
> > > "buRford" wrote:
> > >
> > > > Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
> > > > the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
> > > > wmiprvse.exe starts.
> > > > My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
> > > > 99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
> > > > time it happens. If I bootup later in the day, all's cool... only happens first bootup of
> > > > the day.
> > > > If I disable WU, all is cool.
> > > >
> > > > The only connections that open are to windows update, during this lag.
> > > > As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
> > > > plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.
> > > >
> > > > I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
> > > > returned error: 4200."
> > > > In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
> > > > 0x80041002."
> > > >
> > > > Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
> > > > No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
> > > > do nothing, then I have no problems.
> > > >
> > > > I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
> > > > Right now, I have WU disabled, but I'd prefer to be notified when
> > > >
> > > > Anyone have any idea what might be going on, or where I can look on my system to
> > > > troubleshoot this? Anywhere I can find out what is using SVCHOST?
> > > > Any help is appreciated... thanks!
> > > >

Also my reasoning for posting here is I have about 10 machines that
started doing this 2 weeks ago.
Kirk


kirk.mcc...@gmail.com wrote:
> But here's the thing, an MVP has not come along and explained this. So
> my thoughts would conclude that the great evil empire is doing
> something behind our backs. Hum maybe like forcing windows genuine
> advantage on us?
>
> The further we go the more I think that computers as we know them are
> doomed. MS is mostly crap. And most linuxes are following in their
> footsteps. Yea for MAC...
>
> Kirk
> BTW. I am a hardcore windows admin.
>
> McDoogie wrote:
> > Evening Folks:..Just noticed something of interest in the 'MIcrosoft Update'
> > site, one can now go in and "Change Settings", which allows one to just scan
> > and get updates for Windows [the old way !] and forget about updates for all
> > the other Microsoft Software programs, which require updates much less
> > frequently, this will free up a pile of CPU usage at Boot as each and every
> > time one' boot's up', you'll only be checking for Windows patches not the
> > whole shooting match....Have to check off the change however if one wants to
> > go this way !! McDoogie
> >
> > "NeoX2K5" wrote:
> >
> > > Hey BuRford,
> > >
> > > i had the same problem just 1 hour ago, but i think i've found the reason now.
> > > At first i had disabled all network-devices and tried a lot to solve the
> > > problem, but nothing brought the excepted result.
> > >
> > > You wrote that you have checked your PC with NOD32 ... just try to uninstall
> > > it.
> > > Don't know why, but it works (on my PC) ...
> > >
> > > "McDoogie" wrote:
> > >
> > > > For two weeks I have been experiencing the same CPU overload that Tiny Tim
> > > > and buFord have related to, it just dawned on me that it started when I
> > > > downloaded the "Microsoft Update" feature in lieu of 'Windows Update' site !
> > > > After all systems were booted up and stable [NAV, Zone Alarm, etc.] I have
> > > > had to wait as long as 4 minutes while SVCHost.exe robbed the CPU running at
> > > > 70 to 75% usage all the while no other access was possible as total CPU Usage
> > > > was always 100% while SCVHost was running. Disabled the Microsoft/Windows
> > > > Update feature alltogether and success, I now have my PC back running the way
> > > > it used to ! ...NOW, is somebody going to wake up on the west coast out there
> > > > and fix this problem, or, shall we all just run our systems without knowing
> > > > if we are up todate with the latest patches, etc. ?? .........cheers;
> > > > McDoogie
> > > >
> > > > "buRford" wrote:
> > > >
> > > > > Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
> > > > > the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
> > > > > wmiprvse.exe starts.
> > > > > My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
> > > > > 99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
> > > > > time it happens. If I bootup later in the day, all's cool... only happens first bootup of
> > > > > the day.
> > > > > If I disable WU, all is cool.
> > > > >
> > > > > The only connections that open are to windows update, during this lag.
> > > > > As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
> > > > > plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.
> > > > >
> > > > > I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
> > > > > returned error: 4200."
> > > > > In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
> > > > > 0x80041002."
> > > > >
> > > > > Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
> > > > > No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
> > > > > do nothing, then I have no problems.
> > > > >
> > > > > I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
> > > > > Right now, I have WU disabled, but I'd prefer to be notified when
> > > > >
> > > > > Anyone have any idea what might be going on, or where I can look on my system to
> > > > > troubleshoot this? Anywhere I can find out what is using SVCHOST?
> > > > > Any help is appreciated... thanks!
> > > > >

u r not alone in this cpu hogging problem! I've got cleanly installed xp sp
2 machines with this issue--- bad performance since!



<> wrote in message
news: ups.com...
> Also my reasoning for posting here is I have about 10 machines that
> started doing this 2 weeks ago.
> Kirk
>
>
> kirk.mcc...@gmail.com wrote:
>> But here's the thing, an MVP has not come along and explained this. So
>> my thoughts would conclude that the great evil empire is doing
>> something behind our backs. Hum maybe like forcing windows genuine
>> advantage on us?
>>
>> The further we go the more I think that computers as we know them are
>> doomed. MS is mostly crap. And most linuxes are following in their
>> footsteps. Yea for MAC...
>>
>> Kirk
>> BTW. I am a hardcore windows admin.
>>
>> McDoogie wrote:
>> > Evening Folks:..Just noticed something of interest in the 'MIcrosoft
>> > Update'
>> > site, one can now go in and "Change Settings", which allows one to just
>> > scan
>> > and get updates for Windows [the old way !] and forget about updates
>> > for all
>> > the other Microsoft Software programs, which require updates much less
>> > frequently, this will free up a pile of CPU usage at Boot as each and
>> > every
>> > time one' boot's up', you'll only be checking for Windows patches not
>> > the
>> > whole shooting match....Have to check off the change however if one
>> > wants to
>> > go this way !! McDoogie
>> >
>> > "NeoX2K5" wrote:
>> >
>> > > Hey BuRford,
>> > >
>> > > i had the same problem just 1 hour ago, but i think i've found the
>> > > reason now.
>> > > At first i had disabled all network-devices and tried a lot to solve
>> > > the
>> > > problem, but nothing brought the excepted result.
>> > >
>> > > You wrote that you have checked your PC with NOD32 ... just try to
>> > > uninstall
>> > > it.
>> > > Don't know why, but it works (on my PC) ...
>> > >
>> > > "McDoogie" wrote:
>> > >
>> > > > For two weeks I have been experiencing the same CPU overload that
>> > > > Tiny Tim
>> > > > and buFord have related to, it just dawned on me that it started
>> > > > when I
>> > > > downloaded the "Microsoft Update" feature in lieu of 'Windows
>> > > > Update' site !
>> > > > After all systems were booted up and stable [NAV, Zone Alarm, etc.]
>> > > > I have
>> > > > had to wait as long as 4 minutes while SVCHost.exe robbed the CPU
>> > > > running at
>> > > > 70 to 75% usage all the while no other access was possible as total
>> > > > CPU Usage
>> > > > was always 100% while SCVHost was running. Disabled the
>> > > > Microsoft/Windows
>> > > > Update feature alltogether and success, I now have my PC back
>> > > > running the way
>> > > > it used to ! ...NOW, is somebody going to wake up on the west coast
>> > > > out there
>> > > > and fix this problem, or, shall we all just run our systems without
>> > > > knowing
>> > > > if we are up todate with the latest patches, etc. ??
>> > > > .........cheers;
>> > > > McDoogie
>> > > >
>> > > > "buRford" wrote:
>> > > >
>> > > > > Hi - - Over the past month, I've noticed some strange behavior
>> > > > > after my first bootup of
>> > > > > the day... about 30 secs - a minute after bootup, wuauclt.exe
>> > > > > starts, then shortly after
>> > > > > wmiprvse.exe starts.
>> > > > > My CPU spikes to 99%, and everything hangs. One entry of svchost
>> > > > > spikes to
>> > > > > 99% CPU usage. Then after 30 seconds or so, all goes back to
>> > > > > normal. This is the only
>> > > > > time it happens. If I bootup later in the day, all's cool...
>> > > > > only happens first bootup of
>> > > > > the day.
>> > > > > If I disable WU, all is cool.
>> > > > >
>> > > > > The only connections that open are to windows update, during this
>> > > > > lag.
>> > > > > As far as I can tell, I've scanned with my AV (NOD32), Outpost
>> > > > > Firewall anti-spyware
>> > > > > plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is
>> > > > > clean.
>> > > > >
>> > > > > I don't know if this has any relevance: In my wmiprov.log I'll
>> > > > > get an entry "WDM call
>> > > > > returned error: 4200."
>> > > > > In wbemess.log, I get five entries of "NT Event Log Consumer:
>> > > > > could not retrieve sid,
>> > > > > 0x80041002."
>> > > > >
>> > > > > Nothing abnormal shows up in the System or Application entries of
>> > > > > EVENT VIEWER.
>> > > > > No other abnormal behavior or errors ever... if I wait a minute
>> > > > > or two after bootup, and
>> > > > > do nothing, then I have no problems.
>> > > > >
>> > > > > I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
>> > > > > Right now, I have WU disabled, but I'd prefer to be notified when
>> > > > >
>> > > > > Anyone have any idea what might be going on, or where I can look
>> > > > > on my system to
>> > > > > troubleshoot this? Anywhere I can find out what is using
>> > > > > SVCHOST?
>> > > > > Any help is appreciated... thanks!
>> > > > >
>

QXER wrote:
> u r not alone in this cpu hogging problem! I've got cleanly installed xp sp
> 2 machines with this issue--- bad performance since!
>
>
>
> <> wrote in message
> news: ups.com...
> > Also my reasoning for posting here is I have about 10 machines that
> > started doing this 2 weeks ago.
> > Kirk
> >
> >
> > kirk.mcc...@gmail.com wrote:
> >> But here's the thing, an MVP has not come along and explained this. So
> >> my thoughts would conclude that the great evil empire is doing
> >> something behind our backs. Hum maybe like forcing windows genuine
> >> advantage on us?
> >>
> >> The further we go the more I think that computers as we know them are
> >> doomed. MS is mostly crap. And most linuxes are following in their
> >> footsteps. Yea for MAC...
> >>
> >> Kirk
> >> BTW. I am a hardcore windows admin.
> >>
> >> McDoogie wrote:
> >> > Evening Folks:..Just noticed something of interest in the 'MIcrosoft
> >> > Update'
> >> > site, one can now go in and "Change Settings", which allows one to just
> >> > scan
> >> > and get updates for Windows [the old way !] and forget about updates
> >> > for all
> >> > the other Microsoft Software programs, which require updates much less
> >> > frequently, this will free up a pile of CPU usage at Boot as each and
> >> > every
> >> > time one' boot's up', you'll only be checking for Windows patches not
> >> > the
> >> > whole shooting match....Have to check off the change however if one
> >> > wants to
> >> > go this way !! McDoogie
> >> >
> >> > "NeoX2K5" wrote:
> >> >
> >> > > Hey BuRford,
> >> > >
> >> > > i had the same problem just 1 hour ago, but i think i've found the
> >> > > reason now.
> >> > > At first i had disabled all network-devices and tried a lot to solve
> >> > > the
> >> > > problem, but nothing brought the excepted result.
> >> > >
> >> > > You wrote that you have checked your PC with NOD32 ... just try to
> >> > > uninstall
> >> > > it.
> >> > > Don't know why, but it works (on my PC) ...
> >> > >
> >> > > "McDoogie" wrote:
> >> > >
> >> > > > For two weeks I have been experiencing the same CPU overload that
> >> > > > Tiny Tim
> >> > > > and buFord have related to, it just dawned on me that it started
> >> > > > when I
> >> > > > downloaded the "Microsoft Update" feature in lieu of 'Windows
> >> > > > Update' site !
> >> > > > After all systems were booted up and stable [NAV, Zone Alarm, etc.]
> >> > > > I have
> >> > > > had to wait as long as 4 minutes while SVCHost.exe robbed the CPU
> >> > > > running at
> >> > > > 70 to 75% usage all the while no other access was possible as total
> >> > > > CPU Usage
> >> > > > was always 100% while SCVHost was running. Disabled the
> >> > > > Microsoft/Windows
> >> > > > Update feature alltogether and success, I now have my PC back
> >> > > > running the way
> >> > > > it used to ! ...NOW, is somebody going to wake up on the west coast
> >> > > > out there
> >> > > > and fix this problem, or, shall we all just run our systems without
> >> > > > knowing
> >> > > > if we are up todate with the latest patches, etc. ??
> >> > > > .........cheers;
> >> > > > McDoogie
> >> > > >
> >> > > > "buRford" wrote:
> >> > > >
> >> > > > > Hi - - Over the past month, I've noticed some strange behavior
> >> > > > > after my first bootup of
> >> > > > > the day... about 30 secs - a minute after bootup, wuauclt.exe
> >> > > > > starts, then shortly after
> >> > > > > wmiprvse.exe starts.
> >> > > > > My CPU spikes to 99%, and everything hangs. One entry of svchost
> >> > > > > spikes to
> >> > > > > 99% CPU usage. Then after 30 seconds or so, all goes back to
> >> > > > > normal. This is the only
> >> > > > > time it happens. If I bootup later in the day, all's cool...
> >> > > > > only happens first bootup of
> >> > > > > the day.
> >> > > > > If I disable WU, all is cool.
> >> > > > >
> >> > > > > The only connections that open are to windows update, during this
> >> > > > > lag.
> >> > > > > As far as I can tell, I've scanned with my AV (NOD32), Outpost
> >> > > > > Firewall anti-spyware
> >> > > > > plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is
> >> > > > > clean.
> >> > > > >
> >> > > > > I don't know if this has any relevance: In my wmiprov.log I'll
> >> > > > > get an entry "WDM call
> >> > > > > returned error: 4200."
> >> > > > > In wbemess.log, I get five entries of "NT Event Log Consumer:
> >> > > > > could not retrieve sid,
> >> > > > > 0x80041002."
> >> > > > >
> >> > > > > Nothing abnormal shows up in the System or Application entries of
> >> > > > > EVENT VIEWER.
> >> > > > > No other abnormal behavior or errors ever... if I wait a minute
> >> > > > > or two after bootup, and
> >> > > > > do nothing, then I have no problems.
> >> > > > >
> >> > > > > I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
> >> > > > > Right now, I have WU disabled, but I'd prefer to be notified when
> >> > > > >
> >> > > > > Anyone have any idea what might be going on, or where I can look
> >> > > > > on my system to
> >> > > > > troubleshoot this? Anywhere I can find out what is using
> >> > > > > SVCHOST?
> >> > > > > Any help is appreciated... thanks!
> >> > > > >
> >>>>>>>>Just got back from a service call on the job and ran into this issue. I tried everything, corporate virus scan, spyware, network drivers, reinstalling IE, etc. I noticed on this system, it only happened on the intial startup of IE. Not sure if it was mentioned before, but I found this through using the sys internals process explorer which listed the good ol windows updater running below the svc host. After killing the svc host process, the internet and system ran perfect. I disabled the windows update throught the registry hkey local machine\software\microsoft\windows\policies\window s update and through the startup services using msconfig, but the svchost still hangs. I know our network pushes windows updates, but I thought disabling the service and registry would fix, nope. Im going to try uninstalling windows unintelligent background screw up service to see if this fixes the issue, will write again if it does.

Well it doesn't look like the July 11 patches/security blankets did much to
fix our problem ! In fact the reverse is true. Before the patches were
installed, with Auto. Update turned on, my PC took 3 1/2 min's. after bootup
[that is, after everything else had loaded] to go thru the SVCHost @ 100% CPU
running thingme !! Now it takes 7 1/2 min's. to go thru the SCVHost 100% CPU
usage tribulation. Progress eh ? Guess I'll go read the paper as I can't
use the machine until all this other stuff quit's cluttering up my machine.
.........McDoogie

"air_bolin" wrote:

>
> QXER wrote:
> > u r not alone in this cpu hogging problem! I've got cleanly installed xp sp
> > 2 machines with this issue--- bad performance since!
> >
> >
> >
> > <> wrote in message
> > news: ups.com...
> > > Also my reasoning for posting here is I have about 10 machines that
> > > started doing this 2 weeks ago.
> > > Kirk
> > >
> > >
> > > kirk.mcc...@gmail.com wrote:
> > >> But here's the thing, an MVP has not come along and explained this. So
> > >> my thoughts would conclude that the great evil empire is doing
> > >> something behind our backs. Hum maybe like forcing windows genuine
> > >> advantage on us?
> > >>
> > >> The further we go the more I think that computers as we know them are
> > >> doomed. MS is mostly crap. And most linuxes are following in their
> > >> footsteps. Yea for MAC...
> > >>
> > >> Kirk
> > >> BTW. I am a hardcore windows admin.
> > >>
> > >> McDoogie wrote:
> > >> > Evening Folks:..Just noticed something of interest in the 'MIcrosoft
> > >> > Update'
> > >> > site, one can now go in and "Change Settings", which allows one to just
> > >> > scan
> > >> > and get updates for Windows [the old way !] and forget about updates
> > >> > for all
> > >> > the other Microsoft Software programs, which require updates much less
> > >> > frequently, this will free up a pile of CPU usage at Boot as each and
> > >> > every
> > >> > time one' boot's up', you'll only be checking for Windows patches not
> > >> > the
> > >> > whole shooting match....Have to check off the change however if one
> > >> > wants to
> > >> > go this way !! McDoogie
> > >> >
> > >> > "NeoX2K5" wrote:
> > >> >
> > >> > > Hey BuRford,
> > >> > >
> > >> > > i had the same problem just 1 hour ago, but i think i've found the
> > >> > > reason now.
> > >> > > At first i had disabled all network-devices and tried a lot to solve
> > >> > > the
> > >> > > problem, but nothing brought the excepted result.
> > >> > >
> > >> > > You wrote that you have checked your PC with NOD32 ... just try to
> > >> > > uninstall
> > >> > > it.
> > >> > > Don't know why, but it works (on my PC) ...
> > >> > >
> > >> > > "McDoogie" wrote:
> > >> > >
> > >> > > > For two weeks I have been experiencing the same CPU overload that
> > >> > > > Tiny Tim
> > >> > > > and buFord have related to, it just dawned on me that it started
> > >> > > > when I
> > >> > > > downloaded the "Microsoft Update" feature in lieu of 'Windows
> > >> > > > Update' site !
> > >> > > > After all systems were booted up and stable [NAV, Zone Alarm, etc.]
> > >> > > > I have
> > >> > > > had to wait as long as 4 minutes while SVCHost.exe robbed the CPU
> > >> > > > running at
> > >> > > > 70 to 75% usage all the while no other access was possible as total
> > >> > > > CPU Usage
> > >> > > > was always 100% while SCVHost was running. Disabled the
> > >> > > > Microsoft/Windows
> > >> > > > Update feature alltogether and success, I now have my PC back
> > >> > > > running the way
> > >> > > > it used to ! ...NOW, is somebody going to wake up on the west coast
> > >> > > > out there
> > >> > > > and fix this problem, or, shall we all just run our systems without
> > >> > > > knowing
> > >> > > > if we are up todate with the latest patches, etc. ??
> > >> > > > .........cheers;
> > >> > > > McDoogie
> > >> > > >
> > >> > > > "buRford" wrote:
> > >> > > >
> > >> > > > > Hi - - Over the past month, I've noticed some strange behavior
> > >> > > > > after my first bootup of
> > >> > > > > the day... about 30 secs - a minute after bootup, wuauclt.exe
> > >> > > > > starts, then shortly after
> > >> > > > > wmiprvse.exe starts.
> > >> > > > > My CPU spikes to 99%, and everything hangs. One entry of svchost
> > >> > > > > spikes to
> > >> > > > > 99% CPU usage. Then after 30 seconds or so, all goes back to
> > >> > > > > normal. This is the only
> > >> > > > > time it happens. If I bootup later in the day, all's cool...
> > >> > > > > only happens first bootup of
> > >> > > > > the day.
> > >> > > > > If I disable WU, all is cool.
> > >> > > > >
> > >> > > > > The only connections that open are to windows update, during this
> > >> > > > > lag.
> > >> > > > > As far as I can tell, I've scanned with my AV (NOD32), Outpost
> > >> > > > > Firewall anti-spyware
> > >> > > > > plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is
> > >> > > > > clean.
> > >> > > > >
> > >> > > > > I don't know if this has any relevance: In my wmiprov.log I'll
> > >> > > > > get an entry "WDM call
> > >> > > > > returned error: 4200."
> > >> > > > > In wbemess.log, I get five entries of "NT Event Log Consumer:
> > >> > > > > could not retrieve sid,
> > >> > > > > 0x80041002."
> > >> > > > >
> > >> > > > > Nothing abnormal shows up in the System or Application entries of
> > >> > > > > EVENT VIEWER.
> > >> > > > > No other abnormal behavior or errors ever... if I wait a minute
> > >> > > > > or two after bootup, and
> > >> > > > > do nothing, then I have no problems.
> > >> > > > >
> > >> > > > > I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
> > >> > > > > Right now, I have WU disabled, but I'd prefer to be notified when
> > >> > > > >
> > >> > > > > Anyone have any idea what might be going on, or where I can look
> > >> > > > > on my system to
> > >> > > > > troubleshoot this? Anywhere I can find out what is using
> > >> > > > > SVCHOST?
> > >> > > > > Any help is appreciated... thanks!
> > >> > > > >
> > >>>>>>>>Just got back from a service call on the job and ran into this issue. I tried everything, corporate virus scan, spyware, network drivers, reinstalling IE, etc. I noticed on this system, it only happened on the intial startup of IE. Not sure if it was mentioned before, but I found this through using the sys internals process explorer which listed the good ol windows updater running below the svc host. After killing the svc host process, the internet and system ran perfect. I disabled the windows update throught the registry hkey local machine\software\microsoft\windows\policies\window s update and through the startup services using msconfig, but the svchost still hangs. I know our network pushes windows updates, but I thought disabling the service and registry would fix, nope. Im going to try uninstalling windows unintelligent background screw up service to see if this fixes the issue, will write again if it does.
>
>

wrote:

> But here's the thing, an MVP has not come along and explained this.

Mainly because we don't have any idea what the problem is. None of the PCs
in my care exhibit any such problem, so I cannot investigate any further.

--
Robin Walker [MVP Networking]