SVCHOST 100% CPU

Discussion in 'Windows Small Business Server' started by John Lenz, Feb 19, 2008.

  1. John Lenz

    John Lenz Guest

    I am getting routine 100% CPU pegging on my WinXP client. I have looked into
    forums and they suggest auto update. I just upgraded to WSUS 3 SP1 and am
    still getting svchost CPU pegging. I installed process Explorer to verify
    that is was the checking for auto updates that was causing the issues.

    I run Win2K3 SBS R2 with WSUS 3 SP1.

    Is there anything I can do to stop this CPU pegging by SVCHOST?

    Thx

    John
     
    John Lenz, Feb 19, 2008
    #1
    1. Advertisements

  2. Automatic Updates may be to blame for this.

    1. Download & install the Windows Update Agent 3 from
    http://support.microsoft.com/kb/926464.

    2. Download & install the KB927891 fix (reinstall it if you had previously
    done so)

    3. Re-set Windows Update & delete the cache, in a command line....

    net stop wuauserv

    del /f /s /q %windir%\SoftwareDistribution\*.*

    net start wuauserv

    wuauclt.exe /detectnow

    4. Then reboot and run WU/Microsoft Update and make sure everything is fully
    patched.

    You may see a couple of residual svchost.exe errors (check the
    date/timestamps; they are probably old) but this should do it.
     
    Lanwench [MVP - Exchange], Feb 19, 2008
    #2
    1. Advertisements

  3. John Lenz

    John Lenz Guest

    Hi & Thanks,

    I tried the changes you suggested. They have not worked. I am looking at a
    pegged CPU for over an hour. Process explorer shows the guilty SVCHOST as
    running wcauclt.exe.

    Here is what happened during the "fix" process.

    When I installed agent3 (WindowsUPdateAgent30-x86) my systems responded that
    it was already installed.
    I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
    I then stopped the service and deleted the folder files as described
    Next I restarted the service and ran /detectnow.

    I let that run for a few minutes then rebooted.
    After re-boot, it worked for a while (it usually pegged right away), but
    soon thereafter, the SVCHOST pegging restarted.

    It is only on this one PC. Did I do anything wrong in your process steps?

    Thanks, this is driving me crazy. This system is my prime client that I use.

    John

    "Lanwench [MVP - Exchange]"
     
    John Lenz, Feb 20, 2008
    #3
  4. In task manager, find the PID of the svchost process - you may have to use
    View | Select Columns to show PID.

    From a command prompt, run "tasklist /svc"

    Find the PID for the particular svchost process that's using high CPU, and
    post back with the list of processes running in that instance of svchost.

    --
    Les Connor [SBS MVP]
    ________________________
    Get the SBS BPA here:
    http://support.microsoft.com/kb/940439/en-us


     
    Les Connor [SBS MVP], Feb 20, 2008
    #4
  5. John Lenz

    John Lenz Guest

    Les,

    Next time I will capture what you are looking for.

    I have Process Explorer (SysInternals) running
    In the interim, when it pegged, I killed the capture agent, but the CPU load
    continued and the process was queuing.dll!Dllinstall+0x1cf37

    Does this help narrow the problem

    Thx for all your help.

    John

     
    John Lenz, Feb 20, 2008
    #5
  6. It doesn't help me any, but perhaps someone else recognizes something.

    --
    Les Connor [SBS MVP]
    ________________________
    Get the SBS BPA here:
    http://support.microsoft.com/kb/940439/en-us


     
    Les Connor [SBS MVP], Feb 20, 2008
    #6
  7. John Lenz

    John Lenz Guest

    Les - spell check accidentally changed Dll name

    it is -> wuaueng.dll!Dllinstall+0x1cf37

    Sorry for the confusion. I hope this helps

    John

     
    John Lenz, Feb 20, 2008
    #7
  8. That's a dll related to windows update, that's about all I know. Whether, or
    how, it's related to your issue isn't known, though.

    The output from tasklist would be more helpful, to me at least.

    --
    Les Connor [SBS MVP]
    ________________________
    Get the SBS BPA here:
    http://support.microsoft.com/kb/940439/en-us


     
    Les Connor [SBS MVP], Feb 20, 2008
    #8
  9. John Lenz

    John Lenz Guest

    Len

    Here is the readout you requested

    PID 1848

    wuauserv
    EventSystem
    Browser
    CryptSvc
    DHCP
    TrkWks
    ERSVC
    helpsvc
    dmserver
    Netman
    Nla
    RasMan
    Seclogon
    WSCSVC
    lanmanserver
    ShellHWDetection
    SENS
    Srservice
    Schedule
    TapiSrv
    Themes
    AudioSrv
    SharedAccess
    winmgmt
    W32Time
    WZCSVC
    lanmanworkstation

    A long list. When I kill wuauserv, wuaueng.dll kicks in. When I kill that,
    theystem stabaizes.

    Thx

     
    John Lenz, Feb 20, 2008
    #9
  10. based on that, Lanwench should have covered the issue. Go back over that
    post and make sure.

    --
    Les Connor [SBS MVP]
    ________________________
    Get the SBS BPA here:
    http://support.microsoft.com/kb/940439/en-us


     
    Les Connor [SBS MVP], Feb 21, 2008
    #10
  11. John Lenz

    John Lenz Guest

    Guys,

    I reapplied and it still pegs. This occurs on only one of my PCs
    (unfortunately - mine). I will reformat C: drive and re-install XP SP2 and
    see if that clears it up.

    Thx for your help.

    John
     
    John Lenz, Feb 28, 2008
    #11
  12. John Lenz

    ncdave4life Guest


    Thank you, LanWench, your advice fixed it for me.

    The old wuaueng.dll was dated 4/14/2008. The new wuaueng.dll is dated 6/2/2012, downloaded from the link halfway down the page at the KB926464 page:

    "Windows Update Agent stand-alone installer for 32-bit (X86-based) computers"
    http://download.windowsupdate.com/v6/windowsupdate/redist/standalone/WindowsUpdateAgent20-x86.exe

    Now svchost no longer pegs the CPU at 100%. (Before the fix, the machine was nearly unusable unless I lowered the priority of svchost using ProcessExplorer or TaskManager.)

    Background synopsis (how I got into this mess): After cleaning malware froman old XP Pro machine w/ IE8 & SP3 installed, Windows reported that it wascounterfeit, legitcheck.hta showed a blank white window, and MGADiag reported "blocked VLK," even though this Dell machine has a Dell OEM XP Pro license sticker. I invalidated HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents\OOBETimer so that \WINDOWS\system32\oobe\msoobe.exe /a would run, but it reported a blank Installation ID, and Microsoft phone activation people refused to help without opening a paid support incident. I did a repair install, using an OEM copy of XP Pro w/ SP3 and IE7 slipstreamed, and the "counterfeit software" warning went away, but svchost was still pegging the CPU at 100%, and now IE7 wouldn't run. IE8 wouldn't install; it was supposedly installing updates all night, and never finished. IE7had the same problem, but after I put your recommended wuaueng.dll update on, I was able to install IE7, which gave me the ability to do windows updates, and I'm now a much happier man.

    If you visit the Raleigh area, look me up (e.g., via my geeksalive.com site), and I'll buy you lunch, LanWench!
     
    ncdave4life, Jan 12, 2014
    #12
  13. John Lenz

    Joe Guest

    On Sun, 12 Jan 2014 03:45:22 -0800 (PST)
    You'll have to try a bit harder to track her down. This group has been
    abandoned for a couple of years, with the action now at:

    http://social.technet.microsoft.com/Forums/en-US/home?forum=smallbusinessserver

    I haven't seen any sign of Lanwench since then, a lot of the regulars
    didn't seem to move into the somewhat uncomfortable new surroundings. I
    only post occasionally, and it's a matter of luck and reading goat
    entrails as to which browser might work for me, with what settings. MS
    seems to feel the need to tinker constantly with the site.
     
    Joe, Jan 12, 2014
    #13
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.