Windows update 100% cpu at every boot killing me

[Jim]

Every reboot, windows update runs 100% cpu for 5 7 minutes.
if I turn off automatic updates it doesnt happen.
(but then...no updates. so not a solution).

its xp pro.

I renamed windowsupdate.log (old) because I thought 1500k was
pretty big, might have been slowing it down. this had no effect.

windows update from IE6 and IE7 works fine.

I dont understand the log and I dont know why it ramps the cpu
every time I reboot this machine. this has been going on for
about 3 months and I am tired of that.

how do I reinstall windows update totally
or reslove this problem?

thanks
James

[MowGreen [MVP]]

Jim,

Here's a temporary workaround. Go to Start > Run > type in

net stop wuauserv
Click OK or press Enter

Show hidden files, folders, and system files
http://www.bleepingcomputer.com/tuto...l62.html#winxp

Navigate to WINDOWS\SoftwareDistribution\DataStore
Delete the *contents* of the Logs folder and delete DataStore.edb
NOTE: Deleting the above will mean that the update history shown at
Windows|Microsoft Update will be cleared. Until updates are once again
done from either site, nothing will be listed.

Open the WINDOWS\SoftwareDistribution\Download folder and delete *all*
contents.
Close the window

Empty the Recyle Bin
Go back to Start > Run > type in

net start wuauserv
Click OK or press Enter

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============



Jim wrote:

> Every reboot, windows update runs 100% cpu for 5 7 minutes.
> if I turn off automatic updates it doesnt happen.
> (but then...no updates. so not a solution).
>
> its xp pro.
>
> I renamed windowsupdate.log (old) because I thought 1500k was
> pretty big, might have been slowing it down. this had no effect.
>
> windows update from IE6 and IE7 works fine.
>
> I dont understand the log and I dont know why it ramps the cpu
> every time I reboot this machine. this has been going on for
> about 3 months and I am tired of that.
>
> how do I reinstall windows update totally
> or reslove this problem?
>
> thanks
> James
>
>

[Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]]

Download the hotfix would be my recommendation. KB927891

MowGreen [MVP] wrote:
> Jim,
>
> Here's a temporary workaround. Go to Start > Run > type in
>
> net stop wuauserv
> Click OK or press Enter
>
> Show hidden files, folders, and system files
> http://www.bleepingcomputer.com/tuto...l62.html#winxp
>
> Navigate to WINDOWS\SoftwareDistribution\DataStore
> Delete the *contents* of the Logs folder and delete DataStore.edb
> NOTE: Deleting the above will mean that the update history shown at
> Windows|Microsoft Update will be cleared. Until updates are once again
> done from either site, nothing will be listed.
>
> Open the WINDOWS\SoftwareDistribution\Download folder and delete *all*
> contents.
> Close the window
>
> Empty the Recyle Bin
> Go back to Start > Run > type in
>
> net start wuauserv
> Click OK or press Enter
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> Jim wrote:
>
>> Every reboot, windows update runs 100% cpu for 5 7 minutes.
>> if I turn off automatic updates it doesnt happen.
>> (but then...no updates. so not a solution).
>>
>> its xp pro.
>>
>> I renamed windowsupdate.log (old) because I thought 1500k was
>> pretty big, might have been slowing it down. this had no effect.
>>
>> windows update from IE6 and IE7 works fine.
>>
>> I dont understand the log and I dont know why it ramps the cpu
>> every time I reboot this machine. this has been going on for
>> about 3 months and I am tired of that.
>>
>> how do I reinstall windows update totally
>> or reslove this problem?
>>
>> thanks
>> James
>>
>>

[MowGreen [MVP]]

It works sometimes, sometimes not, from the reports I've been reading.

MG


Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:

> Download the hotfix would be my recommendation. KB927891
>
> MowGreen [MVP] wrote:
>
>> Jim,
>>
>> Here's a temporary workaround. Go to Start > Run > type in
>>
>> net stop wuauserv
>> Click OK or press Enter
>>
>> Show hidden files, folders, and system files
>> http://www.bleepingcomputer.com/tuto...l62.html#winxp
>>
>> Navigate to WINDOWS\SoftwareDistribution\DataStore
>> Delete the *contents* of the Logs folder and delete DataStore.edb
>> NOTE: Deleting the above will mean that the update history shown at
>> Windows|Microsoft Update will be cleared. Until updates are once again
>> done from either site, nothing will be listed.
>>
>> Open the WINDOWS\SoftwareDistribution\Download folder and delete *all*
>> contents.
>> Close the window
>>
>> Empty the Recyle Bin
>> Go back to Start > Run > type in
>>
>> net start wuauserv
>> Click OK or press Enter
>>
>> MowGreen [MVP 2003-2007]
>> ===============
>> *-343-* FDNY
>> Never Forgotten
>> ===============
>>
>>
>>
>> Jim wrote:
>>
>>> Every reboot, windows update runs 100% cpu for 5 7 minutes.
>>> if I turn off automatic updates it doesnt happen.
>>> (but then...no updates. so not a solution).
>>>
>>> its xp pro.
>>>
>>> I renamed windowsupdate.log (old) because I thought 1500k was
>>> pretty big, might have been slowing it down. this had no effect.
>>>
>>> windows update from IE6 and IE7 works fine.
>>>
>>> I dont understand the log and I dont know why it ramps the cpu
>>> every time I reboot this machine. this has been going on for
>>> about 3 months and I am tired of that.
>>>
>>> how do I reinstall windows update totally
>>> or reslove this problem?
>>>
>>> thanks
>>> James
>>>
>>>

[ShadowSpirit]

I made a batch file with your instructions. You can copy the below, paste it
in notepad (Start -> Run -> notepad.exe) and save it as anything.BAT (Save as
Type - all files). The only thing I've noticed from this fix is that if
you've setup your computer to do the Microsoft Updates (which includes
Office), it will reset back to Windows Updates. Not sure yet if the original
problem returns.

===copy below===
@echo off
net stop wuauserv
cd\
cd windows
cd softwaredistribution
cd datastore
del * /q
cd logs
del * /q
cd..
cd..
cd download
del * /q
net start wuauserv

[Ottmar Freudenberger]

"ShadowSpirit" <ShadowSpirit@discussions.microsoft.com> schrieb:

> cd\
> cd windows
> cd softwaredistribution
> cd datastore

You may wanna shorten that to a
cd /d %windir%\Softwaredistribution\datastore
just in case.

Bye,
Freudi

[Greg H]

This problem has affected various systems (not all) at 2 sites I maintain
since the February updates were released.

I created this batch file (which also re-registers the Windows update
components), and it has been successful on some systems and not on others.
---
REM Reregister WU components

REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL


REM Cleanup WU files

net stop WuAuServ
rd /S /Q "%windir%\SoftwareDistribution"
net start WuAuServ
---
I've also installed KB927891 - which I thought was working, but appears to
not be the solution. Strangely, I recently downloaded/installed KB929338 on
a system and noted svchost.exe appeared to max out at only 50%, so the system
was otherwise useable.

I really hope Microsoft resolves this one soon...

[dkblee]

Hi! I;ve tried the hotfix no. kb927891 & 916089 perviously. The problem is
still not solved.

"Susan Bradley, CPA aka Ebitz - SBS Rocks" wrote:

> Download the hotfix would be my recommendation. KB927891
>
> MowGreen [MVP] wrote:
> > Jim,
> >
> > Here's a temporary workaround. Go to Start > Run > type in
> >
> > net stop wuauserv
> > Click OK or press Enter
> >
> > Show hidden files, folders, and system files
> > http://www.bleepingcomputer.com/tuto...l62.html#winxp
> >
> > Navigate to WINDOWS\SoftwareDistribution\DataStore
> > Delete the *contents* of the Logs folder and delete DataStore.edb
> > NOTE: Deleting the above will mean that the update history shown at
> > Windows|Microsoft Update will be cleared. Until updates are once again
> > done from either site, nothing will be listed.
> >
> > Open the WINDOWS\SoftwareDistribution\Download folder and delete *all*
> > contents.
> > Close the window
> >
> > Empty the Recyle Bin
> > Go back to Start > Run > type in
> >
> > net start wuauserv
> > Click OK or press Enter
> >
> > MowGreen [MVP 2003-2007]
> > ===============
> > *-343-* FDNY
> > Never Forgotten
> > ===============
> >
> >
> >
> > Jim wrote:
> >
> >> Every reboot, windows update runs 100% cpu for 5 7 minutes.
> >> if I turn off automatic updates it doesnt happen.
> >> (but then...no updates. so not a solution).
> >>
> >> its xp pro.
> >>
> >> I renamed windowsupdate.log (old) because I thought 1500k was
> >> pretty big, might have been slowing it down. this had no effect.
> >>
> >> windows update from IE6 and IE7 works fine.
> >>
> >> I dont understand the log and I dont know why it ramps the cpu
> >> every time I reboot this machine. this has been going on for
> >> about 3 months and I am tired of that.
> >>
> >> how do I reinstall windows update totally
> >> or reslove this problem?
> >>
> >> thanks
> >> James
> >>
> >>
>

[dkblee]

Hi! I;ve tried the hotfix no. kb927891 & 916089 perviously. The problem is
still not solved.

"Susan Bradley, CPA aka Ebitz - SBS Rocks" wrote:

> Download the hotfix would be my recommendation. KB927891
>
> MowGreen [MVP] wrote:
> > Jim,
> >
> > Here's a temporary workaround. Go to Start > Run > type in
> >
> > net stop wuauserv
> > Click OK or press Enter
> >
> > Show hidden files, folders, and system files
> > http://www.bleepingcomputer.com/tuto...l62.html#winxp
> >
> > Navigate to WINDOWS\SoftwareDistribution\DataStore
> > Delete the *contents* of the Logs folder and delete DataStore.edb
> > NOTE: Deleting the above will mean that the update history shown at
> > Windows|Microsoft Update will be cleared. Until updates are once again
> > done from either site, nothing will be listed.
> >
> > Open the WINDOWS\SoftwareDistribution\Download folder and delete *all*
> > contents.
> > Close the window
> >
> > Empty the Recyle Bin
> > Go back to Start > Run > type in
> >
> > net start wuauserv
> > Click OK or press Enter
> >
> > MowGreen [MVP 2003-2007]
> > ===============
> > *-343-* FDNY
> > Never Forgotten
> > ===============
> >
> >
> >
> > Jim wrote:
> >
> >> Every reboot, windows update runs 100% cpu for 5 7 minutes.
> >> if I turn off automatic updates it doesnt happen.
> >> (but then...no updates. so not a solution).
> >>
> >> its xp pro.
> >>
> >> I renamed windowsupdate.log (old) because I thought 1500k was
> >> pretty big, might have been slowing it down. this had no effect.
> >>
> >> windows update from IE6 and IE7 works fine.
> >>
> >> I dont understand the log and I dont know why it ramps the cpu
> >> every time I reboot this machine. this has been going on for
> >> about 3 months and I am tired of that.
> >>
> >> how do I reinstall windows update totally
> >> or reslove this problem?
> >>
> >> thanks
> >> James
> >>
> >>
>

[Paul.Sillince@gmail.com]

I work in a large network environment and am having the same problems
with the ntdll.dll in svchost taking up 100% cpu. The strange thing is
it seems to be only happening on laptops, whether they are connected
to the network or not. We use WSUS from a central server to maintan
windows updates. Would the work around mentioned above still work in
the WSUS environment.

[dkblee]

I tried the hotfix from Microsoft. That doesn't solve the problem at all. For
my case, this issue only happens on old machine(eg. P3 with 256MB RAM and
only during first 10mins after startup), the newer machine has no problem
with that.

You might want to tried the outfix, i think it did solve the problem on case
by case basis. I read through some newsgroups previously, it does work for
some other people.

"Paul.Sillince@gmail.com" wrote:

>
> I work in a large network environment and am having the same problems
> with the ntdll.dll in svchost taking up 100% cpu. The strange thing is
> it seems to be only happening on laptops, whether they are connected
> to the network or not. We use WSUS from a central server to maintan
> windows updates. Would the work around mentioned above still work in
> the WSUS environment.
>
>

[Jim Byrd]

Hi Paul - The following has apparently worked for all those that have used
it. This is a general post intended for all levels of users:


How knowledgable about doing things are you? Do you know how to start and
stop services? How to run a .cmd file? If not, you'll need access to
someone who does to avoid problems. The following assumes you're on Windows
XP but will probably work OK for Win2k as well. If you're confident about
what you're doing, then try the following first - only if it doesn't work,
then there's another level of stuff that can be done following:

1. Stop and Disable Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.
2. Rename the folder %SystemRoot%\SoftwareDistribution to
%SystemRoot%\OldSoftwareDistribution
3. Open Notepad and create a file containing the following:

REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL


Save this file as 'Wudll.cmd' (without the quotes) to any convenient
location then exit Notepad and double click on the file you just saved. You
should get a 'Sucess' mesage for each of the .dll's listed above.

4. Now Re-enable to Automatic status and then Start each of the services
you stopped before - Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.

5. Now Reboot. Now Reboot Again. (Yes, twice.)

See if that solves it - give it a couple of days. If so, then you can
delete 'OldSoftwareDistribution'. I would request that you post back with
your results. _Only if the problem does re-occur_, then do the following
_exactly_:

1. Go to http://wiki.djlizard.net/Dial-a-fix and download Dial-a-fix
v0.60.0.24 (2006-10-27) Here's a direct download link:
http://djlizard.net.nyud.net:8080/so...v0.60.0.24.zip and a
secondary: http://djlizard.net/software/Dial-a-fix-v0.60.0.24.zip from
that page's download section, here:
http://wiki.djlizard.net/Dial-a-fix#...C_and_articles .

2. Unzip it to a new folder at root with any name, e.g.
c:\Dial-a-fix-v0.60.0.24

3. Double click on Dial-a-fix.exe in that folder.

4. Click on the following:
Options/tooltips (just to get an idea of what it does in each section.
:) )
Both boxes under Prep
The 'all' (top) box for Sections 2, 3 and 4 (which will automatically
be set when you check 3)
In Section 5, 'Programming cores/runtimes' and
'Explorer/IE/OE/shell/WMP' only.
Click 'Go' . (Some of the re-registrations may take what seems like a
long time for some .dll's - Don't be impatient.)

5. Reboot (if Dial-a-fix doesn't do it automatically at the end). Now
Reboot Again. (Yes, twice.)


See if that does the trick, and, again please post back with your
experience.



MS is well aware of the problem and has provided privately two different
responses concerning a fix:

"I regret to say that I was told that this known issue requires too much
change to be implemented in a hotfix. A change will instead be implemented
in the next Automatic Updates client, which we are planning to release in Q2
this year."

"According to the feedback from Product Development team, this fix will be
published as a security update on the Windows Update site and the relevant
KB article will also be released by us. Therefore, we just need to keep the
system on the network up to date. In addition, the Product Development team
also indicates that the WSUS 3.0 client may contain this patch if this fix
can released timely. At that moment, we can also attempt to upgrade to the
WSUS client 3.0 to test the issue."

--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In news:1177553239.451351.40540@u32g2000prd.googlegroups.com,
Paul.Sillince@gmail.com <Paul.Sillince@gmail.com> typed:
|| I work in a large network environment and am having the same problems
|| with the ntdll.dll in svchost taking up 100% cpu. The strange thing
|| is it seems to be only happening on laptops, whether they are
|| connected to the network or not. We use WSUS from a central server
|| to maintan windows updates. Would the work around mentioned above
|| still work in the WSUS environment.

[gmayer0]

This post has been most helpful. This is the 10th SVCHOST.EXE problem I've
fought and it usually takes 4 hours. (could have reinstalled windows but I
love chasing them down)

you're right. when is microsoft going to get this fixed... it's painful.

SVCHOST.EXE 100% windows update

"Greg H" wrote:

> This problem has affected various systems (not all) at 2 sites I maintain
> since the February updates were released.
>
> I created this batch file (which also re-registers the Windows update
> components), and it has been successful on some systems and not on others.
> ---
> REM Reregister WU components
>
> REGSVR32 WUAPI.DLL
> REGSVR32 WUAUENG.DLL
> REGSVR32 WUAUENG1.DLL
> REGSVR32 ATL.DLL
> REGSVR32 WUCLTUI.DLL
> REGSVR32 WUPS.DLL
> REGSVR32 WUPS2.DLL
> REGSVR32 WUWEB.DLL
>
>
> REM Cleanup WU files
>
> net stop WuAuServ
> rd /S /Q "%windir%\SoftwareDistribution"
> net start WuAuServ
> ---
> I've also installed KB927891 - which I thought was working, but appears to
> not be the solution. Strangely, I recently downloaded/installed KB929338 on
> a system and noted svchost.exe appeared to max out at only 50%, so the system
> was otherwise useable.
>
> I really hope Microsoft resolves this one soon...

[PA Bear [MS MVP]]

[Most "SVCHOST.EXE 100% windows update" issues these days are caused by
hijackware infections, not corruption in the WU data store or files.]

gmayer0 wrote:
> This post has been most helpful. This is the 10th SVCHOST.EXE problem I've
> fought and it usually takes 4 hours. (could have reinstalled windows but I
> love chasing them down)
>
> you're right. when is microsoft going to get this fixed... it's painful.
>
> SVCHOST.EXE 100% windows update
>
> "Greg H" wrote:
>
>> This problem has affected various systems (not all) at 2 sites I maintain
>> since the February updates were released.
>>
>> I created this batch file (which also re-registers the Windows update
>> components), and it has been successful on some systems and not on
>> others.
>> ---
>> REM Reregister WU components
>>
>> REGSVR32 WUAPI.DLL
>> REGSVR32 WUAUENG.DLL
>> REGSVR32 WUAUENG1.DLL
>> REGSVR32 ATL.DLL
>> REGSVR32 WUCLTUI.DLL
>> REGSVR32 WUPS.DLL
>> REGSVR32 WUPS2.DLL
>> REGSVR32 WUWEB.DLL
>>
>>
>> REM Cleanup WU files
>>
>> net stop WuAuServ
>> rd /S /Q "%windir%\SoftwareDistribution"
>> net start WuAuServ
>> ---
>> I've also installed KB927891 - which I thought was working, but appears
>> to
>> not be the solution. Strangely, I recently downloaded/installed KB929338
>> on a system and noted svchost.exe appeared to max out at only 50%, so the
>> system was otherwise useable.
>>
>> I really hope Microsoft resolves this one soon...

[Paul]

Look, I know you are excited to being a microsoft puppy but you need to lay
off the kool-aid for a few minutes. Were all sick and tired of you MS ***
braggarts making ridiculous statements about issues people are experiencing.

This is a HUGE problem regarding windows update. It isn't "hijackware"
infection but piss poor programming on microsofts end.

Think about the above before putting the straw back in your peep hole Shep.


"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
news:uCOVuU6hIHA.1184@TK2MSFTNGP04.phx.gbl...
> [Most "SVCHOST.EXE 100% windows update" issues these days are caused by
> hijackware infections, not corruption in the WU data store or files.]
>
> gmayer0 wrote:
>> This post has been most helpful. This is the 10th SVCHOST.EXE problem
>> I've
>> fought and it usually takes 4 hours. (could have reinstalled windows but
>> I
>> love chasing them down)
>>
>> you're right. when is microsoft going to get this fixed... it's painful.
>>
>> SVCHOST.EXE 100% windows update
>>
>> "Greg H" wrote:
>>
>>> This problem has affected various systems (not all) at 2 sites I
>>> maintain
>>> since the February updates were released.
>>>
>>> I created this batch file (which also re-registers the Windows update
>>> components), and it has been successful on some systems and not on
>>> others.
>>> ---
>>> REM Reregister WU components
>>>
>>> REGSVR32 WUAPI.DLL
>>> REGSVR32 WUAUENG.DLL
>>> REGSVR32 WUAUENG1.DLL
>>> REGSVR32 ATL.DLL
>>> REGSVR32 WUCLTUI.DLL
>>> REGSVR32 WUPS.DLL
>>> REGSVR32 WUPS2.DLL
>>> REGSVR32 WUWEB.DLL
>>>
>>>
>>> REM Cleanup WU files
>>>
>>> net stop WuAuServ
>>> rd /S /Q "%windir%\SoftwareDistribution"
>>> net start WuAuServ
>>> ---
>>> I've also installed KB927891 - which I thought was working, but appears
>>> to
>>> not be the solution. Strangely, I recently downloaded/installed
>>> KB929338
>>> on a system and noted svchost.exe appeared to max out at only 50%, so
>>> the
>>> system was otherwise useable.
>>>
>>> I really hope Microsoft resolves this one soon...
>