Automatic Updates freezing PC (svchost.exe -k netsvcs wuauclt.exe)

[Hugh]

Excellent post.

I have the same issue. It started appearing in February and Hotfix 927891
does not correct it -- only gives my PC a few extra minutes until svchost.exe
grabs 100% of the cpu and the machine locks up.

Just imagine the impact on many folks with PCs without much horsepower -- MS
pushes Microsoft Update out to the masses, then it starts failing without any
apparent explanation or fix. Users struggle to get their machines back and
many disable the automatic update process. Without auto update on the users
never see notice that Microsoft Update has been fixed...

The evil element could not have written a better scenerio! Granted, I was
making an assumption -- that MS Update will be fixed. What a joke.
--
Hugh


"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

[M.J.]

I try to help with what I know... and yet I might repeat myself in this forum
but look at that :

Out of this, I can suggest you to have a look there :
http://support.microsoft.com/kb/916089/

But as far as I can read (5hrs+) lot of people still having this issue.
and as far as I know, there is 1 temporary solution for this and its to
disable the "automatic updates" services. Disable until you need it.

Another "solution", which I didn't have tested yet, is this
http://mygreenpaste.blogspot.com/200...rvices-in.html

In other word you separate wuauclt from the svchost so then you'll be able
to lower the priority, therefor, leaves the comp in a usable state.

Hope it helps.


"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

[M.J.]

I try to help with what I know... and yet I might repeat myself in this forum
but look at that :

Out of this, I can suggest you to have a look there :
http://support.microsoft.com/kb/916089/

But as far as I can read (5hrs+) lot of people still having this issue.
and as far as I know, there is 1 temporary solution for this and its to
disable the "automatic updates" services. Disable until you need it.

Another "solution", which I didn't have tested yet, is this
http://mygreenpaste.blogspot.com/200...rvices-in.html

In other word you separate wuauclt from the svchost so then you'll be able
to lower the priority, therefor, leaves the comp in a usable state.

Hope it helps.


"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

[M.J.]

I try to help with what I know... and yet I might repeat myself in this forum
but look at that :

Out of this, I can suggest you to have a look there :
http://support.microsoft.com/kb/916089/

But as far as I can read (5hrs+) lot of people still having this issue.
and as far as I know, there is 1 temporary solution for this and its to
disable the "automatic updates" services. Disable until you need it.

Another "solution", which I didn't have tested yet, is this
http://mygreenpaste.blogspot.com/200...rvices-in.html

In other word you separate wuauclt from the svchost so then you'll be able
to lower the priority, therefor, leaves the comp in a usable state.

Hope it helps.


"javaguru" wrote:

> I'd imagine this is something that got broken on the last update and is
> currently affecting a lot of other people. There is nothing complicated
> about my Dell home laptop running XP Home SP2...I barely use it, 8-way
> servers at work are more fun to play with. Anyways, I've had Automatic
> Updates turned on to download the updates and then prompt me to install for
> at least 2 years, with no problems. Yesterday evening (April 10 '07) my
> laptop decided to simply freeze - after a hard boot, it froze again within
> about a minute.
>
> After some considerable effort to track the offending process and make sure
> it's not a virus, I am surprised to find that it is Automatic Updates, which
> runs as a service under svchost.exe -k netsvcs. With the updates turned on
> as I've had them for years, I can see that service starting, and a few
> seconds afterwards the parent svchost process starts clocking 100%,
> effectively hosing the machine. This happens within a minute after startup.
>
> Disabling the Automatic Updates service or simply turning automatic updates
> off in Security Center gives me my computer back. However, this is not an
> ideal solution - that service needs to be running to update even manually,
> and when it's started simply by visiting Microsoft's windows update site, the
> same issue manifests. Basically, whenever the Automatic Updates service
> runs, it hogs all the CPU and thus locks up the machine. I used Process
> Explorer and ran through the same sequence of events 3 times to verify this
> beyond any doubt...it's also the only thing I can use to kill the offending
> svchost process and get control back.
>
> Has anyone else run into this? Do you have a better solution? Please post
> if you do. If you don't, go to Control Panel and disable your Automatic
> Updates through the Security Center right upon startup, then quickly reboot -
> at least you'll be able to use your computer that way.

[JB Miha]

You should deploy WSUS and exclude Office updates from detection. Then with
GPO point internal clients to that WSUS. They won't check for Office updates
since they are not present on WSUS server. Good luck.



Miha

[Jim Byrd]

Hi javaguru et al in thread - The following has solved the problem for a
number of folks. This is a general post for all levels of users:


How knowledgable about doing things are you? Do you know how to
start and stop services? How to run a .cmd file? If not, you'll need
access to someone who does to avoid problems. The following assumes you're
on Windows XP. If you're confident about what you're doing, then try the
following first - only if it doesn't work, then there's another level of
stuff that can be done following:

1. Stop and Disable Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.
2. Rename the folder %SystemRoot%\SoftwareDistribution to
%SystemRoot%\OldSoftwareDistribution
3. Open Notepad and create a file containing the following:

REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL


Save this file as 'Wudll.cmd' (without the quotes) to any convenient
location then exit Notepad and double click on the file you just saved. You
should get a 'Sucess' mesage for each of the .dll's listed above.

4. Now Re-enable to Automatic status and then Start each of the services
you stopped before - Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.

5. Now Reboot. Now Reboot Again. (Yes, twice.)

See if that solves it - give it a couple of days. If so, then you can
delete 'OldSoftwareDistribution'. I would request that you post back with
your results. _Only if the problem does re-occur_, then do the following
_exactly_:

1. Go to http://wiki.djlizard.net/Dial-a-fix and download Dial-a-fix
v0.60.0.24 (2006-10-27)

2. Unzip it to a new folder at root with any name, e.g.
c:\Dial-a-fix-v0.60.0.24

3. Double click on Dial-a-fix.exe in that folder.

4. Click on the following:
Options/tooltips (just to get an idea of what it does in each section.
:) )
Both boxes under Prep
The 'all' (top) box for Sections 2, 3 and 4 (which will automatically
be set when you check 3)
In Section 5, 'Programming cores/runtimes' and
'Explorer/IE/OE/shell/WMP' only.
Click 'Go' . (Some of the re-registrations may take what seems like a
long time for some .dll's - Don't be impatient.)

5. Reboot (if Dial-a-fix doesn't do it automatically at the end). Now
Reboot Again. (Yes, twice.)


See if that does the trick, and, again please post back with your
experience.



MS is well aware of this issue. From a private communication:


"I regret to say that I was told that this known issue requires too much
change to be implemented in a hotfix. A change will instead be implemented
in the next Automatic Updates client, which we are planning to release in Q2
this year."


--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In news:818379A2-BEBF-43CF-AFBF-7C6B8D283A7C@microsoft.com,
javaguru <javaguru@discussions.microsoft.com> typed:
|| I'd imagine this is something that got broken on the last update and
|| is currently affecting a lot of other people. There is nothing
|| complicated about my Dell home laptop running XP Home SP2...I barely
|| use it, 8-way servers at work are more fun to play with. Anyways,
|| I've had Automatic Updates turned on to download the updates and
|| then prompt me to install for at least 2 years, with no problems.
|| Yesterday evening (April 10 '07) my laptop decided to simply freeze
|| - after a hard boot, it froze again within about a minute.
||
|| After some considerable effort to track the offending process and
|| make sure it's not a virus, I am surprised to find that it is
|| Automatic Updates, which runs as a service under svchost.exe -k
|| netsvcs. With the updates turned on as I've had them for years, I
|| can see that service starting, and a few seconds afterwards the
|| parent svchost process starts clocking 100%, effectively hosing the
|| machine. This happens within a minute after startup.
||
|| Disabling the Automatic Updates service or simply turning automatic
|| updates off in Security Center gives me my computer back. However,
|| this is not an ideal solution - that service needs to be running to
|| update even manually, and when it's started simply by visiting
|| Microsoft's windows update site, the same issue manifests.
|| Basically, whenever the Automatic Updates service runs, it hogs all
|| the CPU and thus locks up the machine. I used Process Explorer and
|| ran through the same sequence of events 3 times to verify this
|| beyond any doubt...it's also the only thing I can use to kill the
|| offending svchost process and get control back.
||
|| Has anyone else run into this? Do you have a better solution?
|| Please post if you do. If you don't, go to Control Panel and
|| disable your Automatic Updates through the Security Center right
|| upon startup, then quickly reboot - at least you'll be able to use
|| your computer that way.

[jason.behring@gmail.com]

On Apr 15, 9:16 pm, "Jim Byrd" <jrb...@spamless.roadrunner.com> wrote:
> Hi javaguru et al in thread - The following has solved the problem for a
> number of folks. This is a general post for all levels of users:
>
> How knowledgable about doing things are you? Do you know how to
> start and stop services? How to run a .cmd file? If not, you'll need
> access to someone who does to avoid problems. The following assumes you're
> on Windows XP. If you're confident about what you're doing, then try the
> following first - only if it doesn't work, then there's another level of
> stuff that can be done following:
>
> 1. Stop and Disable Automatic Updates, Background Intelligent Transfer
> Service and the Cryptographic Service.
> 2. Rename the folder %SystemRoot%\SoftwareDistribution to
> %SystemRoot%\OldSoftwareDistribution
> 3. Open Notepad and create a file containing the following:
>
> REGSVR32 WUAPI.DLL
> REGSVR32 WUAUENG.DLL
> REGSVR32 WUAUENG1.DLL
> REGSVR32 ATL.DLL
> REGSVR32 WUCLTUI.DLL
> REGSVR32 WUPS.DLL
> REGSVR32 WUPS2.DLL
> REGSVR32 WUWEB.DLL
>
> Save this file as 'Wudll.cmd' (without the quotes) to any convenient
> location then exit Notepad and double click on the file you just saved. You
> should get a 'Sucess' mesage for each of the .dll's listed above.
>
> 4. Now Re-enable to Automatic status and then Start each of the services
> you stopped before - Automatic Updates, Background Intelligent Transfer
> Service and the Cryptographic Service.
>
> 5. Now Reboot. Now Reboot Again. (Yes, twice.)
>
> See if that solves it - give it a couple of days. If so, then you can
> delete 'OldSoftwareDistribution'. I would request that you post back with
> your results. _Only if the problem does re-occur_, then do the following
> _exactly_:
>
> 1. Go tohttp://wiki.djlizard.net/Dial-a-fix and download Dial-a-fix
> v0.60.0.24 (2006-10-27)
>
> 2. Unzip it to a new folder at root with any name, e.g.
> c:\Dial-a-fix-v0.60.0.24
>
> 3. Double click on Dial-a-fix.exe in that folder.
>
> 4. Click on the following:
> Options/tooltips (just to get an idea of what it does in each section.
> :) )
> Both boxes under Prep
> The 'all' (top) box for Sections 2, 3 and 4 (which will automatically
> be set when you check 3)
> In Section 5, 'Programming cores/runtimes' and
> 'Explorer/IE/OE/shell/WMP' only.
> Click 'Go' . (Some of the re-registrations may take what seems like a
> long time for some .dll's - Don't be impatient.)
>
> 5. Reboot (if Dial-a-fix doesn't do it automatically at the end). Now
> Reboot Again. (Yes, twice.)
>
> See if that does the trick, and, again please post back with your
> experience.
>
> MS is well aware of this issue. From a private communication:
>
> "I regret to say that I was told that this known issue requires too much
> change to be implemented in a hotfix. A change will instead be implemented
> in the next Automatic Updates client, which we are planning to release in Q2
> this year."
>
> --
> Regards, Jim Byrd,
> My Blog, Defending Your Machine,http://defendingyourmachine2.blogspot.com/
>
> Innews:818379A2-BEBF-43CF-AFBF-7C6B8D283A7C@microsoft.com,
> javaguru <javag...@discussions.microsoft.com> typed:
> || I'd imagine this is something that got broken on the last update and
> || is currently affecting a lot of other people. There is nothing
> || complicated about my Dell home laptop running XP Home SP2...I barely
> || use it, 8-way servers at work are more fun to play with. Anyways,
> || I've had Automatic Updates turned on to download the updates and
> || then prompt me to install for at least 2 years, with no problems.
> || Yesterday evening (April 10 '07) my laptop decided to simply freeze
> || - after a hard boot, it froze again within about a minute.
> ||
> || After some considerable effort to track the offending process and
> || make sure it's not a virus, I am surprised to find that it is
> || Automatic Updates, which runs as a service under svchost.exe -k
> || netsvcs. With the updates turned on as I've had them for years, I
> || can see that service starting, and a few seconds afterwards the
> || parent svchost process starts clocking 100%, effectively hosing the
> || machine. This happens within a minute after startup.
> ||
> || Disabling the Automatic Updates service or simply turning automatic
> || updates off in Security Center gives me my computer back. However,
> || this is not an ideal solution - that service needs to be running to
> || update even manually, and when it's started simply by visiting
> || Microsoft's windows update site, the same issue manifests.
> || Basically, whenever the Automatic Updates service runs, it hogs all
> || the CPU and thus locks up the machine. I used Process Explorer and
> || ran through the same sequence of events 3 times to verify this
> || beyond any doubt...it's also the only thing I can use to kill the
> || offending svchost process and get control back.
> ||
> || Has anyone else run into this? Do you have a better solution?
> || Please post if you do. If you don't, go to Control Panel and
> || disable your Automatic Updates through the Security Center right
> || upon startup, then quickly reboot - at least you'll be able to use
> || your computer that way.

I've fixed this - here you go

http://www.fugnut.com