Windows Update 100% CPU usage issue - a NEW twist on an old proble

Posting this hoping that someone in the WIndows Update team is aware of and
looking at this problem. I am 100% sure there is a new issue with
servicehost.exe process taking 100% CPU. The bahavior is similar but
actually worse than the problem of a year or so ago that was patched. This
is a NEW issue.

Since Tuesday a significant number of our customers (most are fully up to
date XP SP2, all flavors) are having issues with Windows update taking 100%
of CPU. On a single processor system the PC goes to 100% CPU and never
clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
core CPU one thread runs the one cpu to 100% but the remainder of the PC is
stable. A work-around is disabling auto-update.

We have had 2 Vista systems showing similar behavior but not to the same
scale as XP BTW so something is clearly in need of review.

It does not appear to be SP3 itself, nor does it appear to be a latency/load
issue on the WU servers. The PCs we have had this on are all different OEMs,
different ISPs, different sites etc. the common thread is this one service
that gets stuck and never clears, unlike the similar issue a year ago that
would eventually clear.

MSFT, please get on top of this before it snowballs.

Asker of stupid questions wrote:
> Posting this hoping that someone in the WIndows Update team is
> aware of and looking at this problem. I am 100% sure there is a
> new issue with servicehost.exe process taking 100% CPU. The
> bahavior is similar but actually worse than the problem of a year
> or so ago that was patched. This is a NEW issue.
>
> Since Tuesday a significant number of our customers (most are fully
> up to date XP SP2, all flavors) are having issues with Windows
> update taking 100% of CPU. On a single processor system the PC
> goes to 100% CPU and never clears, we have left 2 systems over 5+
> hours. On a hyper threaded or dual core CPU one thread runs the
> one cpu to 100% but the remainder of the PC is stable. A
> work-around is disabling auto-update.
>
> We have had 2 Vista systems showing similar behavior but not to the
> same scale as XP BTW so something is clearly in need of review.
>
> It does not appear to be SP3 itself, nor does it appear to be a
> latency/load issue on the WU servers. The PCs we have had this on
> are all different OEMs, different ISPs, different sites etc. the
> common thread is this one service that gets stuck and never clears,
> unlike the similar issue a year ago that would eventually clear.
>
> MSFT, please get on top of this before it snowballs.

One question - you stated, "most are fully up to date XP SP2, all flavors"
then state, "It does not appear to be SP3 itself" <- do you mean it does not
appear to be the attempted installation of SP3?

I have not seen this issue on the few hundred I have running SP2+ all
updates right before SP3 nor on the couple of hundred running SP3 - so...
There must be more to this.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

FYI - These PCs are not in a managed environment, these are all stand alone,
a mix of pro and home.
The issue appears not to be the download of SP3 itself. It happens at the
initial review of WU on the PC when WU is deciding what needs to be done
with/to the PC.
PCs are at SP2 when they get stuck, we have had a couple that sp3 install
"fixed" the issue but most are not getting that far, and some post SP3
install are still getting stuck in the same way.

it is random, in terms of who gets impacted but the impacted behavior is
consistant.

"Shenan Stanley" wrote:

> Asker of stupid questions wrote:
> > Posting this hoping that someone in the WIndows Update team is
> > aware of and looking at this problem. I am 100% sure there is a
> > new issue with servicehost.exe process taking 100% CPU. The
> > bahavior is similar but actually worse than the problem of a year
> > or so ago that was patched. This is a NEW issue.
> >
> > Since Tuesday a significant number of our customers (most are fully
> > up to date XP SP2, all flavors) are having issues with Windows
> > update taking 100% of CPU. On a single processor system the PC
> > goes to 100% CPU and never clears, we have left 2 systems over 5+
> > hours. On a hyper threaded or dual core CPU one thread runs the
> > one cpu to 100% but the remainder of the PC is stable. A
> > work-around is disabling auto-update.
> >
> > We have had 2 Vista systems showing similar behavior but not to the
> > same scale as XP BTW so something is clearly in need of review.
> >
> > It does not appear to be SP3 itself, nor does it appear to be a
> > latency/load issue on the WU servers. The PCs we have had this on
> > are all different OEMs, different ISPs, different sites etc. the
> > common thread is this one service that gets stuck and never clears,
> > unlike the similar issue a year ago that would eventually clear.
> >
> > MSFT, please get on top of this before it snowballs.
>
> One question - you stated, "most are fully up to date XP SP2, all flavors"
> then state, "It does not appear to be SP3 itself" <- do you mean it does not
> appear to be the attempted installation of SP3?
>
> I have not seen this issue on the few hundred I have running SP2+ all
> updates right before SP3 nor on the couple of hundred running SP3 - so...
> There must be more to this.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Are the machines updating via WSUS?

Are all machines running Windows Update Agent 3.0, v7.0.6000.381?

Is KB927891 installed on all WinXP SP2 machines?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.net


Asker of stupid questions wrote:
> FYI - These PCs are not in a managed environment, these are all stand
> alone,
> a mix of pro and home.
> The issue appears not to be the download of SP3 itself. It happens at the
> initial review of WU on the PC when WU is deciding what needs to be done
> with/to the PC.
> PCs are at SP2 when they get stuck, we have had a couple that sp3 install
> "fixed" the issue but most are not getting that far, and some post SP3
> install are still getting stuck in the same way.
>
> it is random, in terms of who gets impacted but the impacted behavior is
> consistant.
>
> "Shenan Stanley" wrote:
>
>> Asker of stupid questions wrote:
>>> Posting this hoping that someone in the WIndows Update team is
>>> aware of and looking at this problem. I am 100% sure there is a
>>> new issue with servicehost.exe process taking 100% CPU. The
>>> bahavior is similar but actually worse than the problem of a year
>>> or so ago that was patched. This is a NEW issue.
>>>
>>> Since Tuesday a significant number of our customers (most are fully
>>> up to date XP SP2, all flavors) are having issues with Windows
>>> update taking 100% of CPU. On a single processor system the PC
>>> goes to 100% CPU and never clears, we have left 2 systems over 5+
>>> hours. On a hyper threaded or dual core CPU one thread runs the
>>> one cpu to 100% but the remainder of the PC is stable. A
>>> work-around is disabling auto-update.
>>>
>>> We have had 2 Vista systems showing similar behavior but not to the
>>> same scale as XP BTW so something is clearly in need of review.
>>>
>>> It does not appear to be SP3 itself, nor does it appear to be a
>>> latency/load issue on the WU servers. The PCs we have had this on
>>> are all different OEMs, different ISPs, different sites etc. the
>>> common thread is this one service that gets stuck and never clears,
>>> unlike the similar issue a year ago that would eventually clear.
>>>
>>> MSFT, please get on top of this before it snowballs.
>>
>> One question - you stated, "most are fully up to date XP SP2, all
>> flavors"
>> then state, "It does not appear to be SP3 itself" <- do you mean it does
>> not appear to be the attempted installation of SP3?
>>
>> I have not seen this issue on the few hundred I have running SP2+ all
>> updates right before SP3 nor on the couple of hundred running SP3 - so...
>> There must be more to this.
>>
>> --
>> Shenan Stanley
>> MS-MVP
>> --
>> How To Ask Questions The Smart Way
>> http://www.catb.org/~esr/faqs/smart-questions.html

I just had this same problem yesterday with an attempted update and sent a
request for help to support. My computer is not on a network and has XP home
edition with SP2. (I don't think that it has done an automatic update to
SP3.) Yesterday the update scan of my system was taking longer than usual
and since I had to leave I ended up shutting everything down before it was
done. The shut-down took longer than usual. The next time that I booted up
the entire system bogged down and the CPU was running at almost 100% on
something. It would take it almost 5 minutes to respond to a single mouse
click. I ended up restoring the system to some settings from about a month
ago and turned off the automatic update. I will carefully follow the
postings here and hope to hear back on my question from an MS tech within 24
hours.

"PA Bear [MS MVP]" wrote:

> Are the machines updating via WSUS?
>
> Are all machines running Windows Update Agent 3.0, v7.0.6000.381?
>
> Is KB927891 installed on all WinXP SP2 machines?
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin; DTS-L.net
>
>
> Asker of stupid questions wrote:
> > FYI - These PCs are not in a managed environment, these are all stand
> > alone,
> > a mix of pro and home.
> > The issue appears not to be the download of SP3 itself. It happens at the
> > initial review of WU on the PC when WU is deciding what needs to be done
> > with/to the PC.
> > PCs are at SP2 when they get stuck, we have had a couple that sp3 install
> > "fixed" the issue but most are not getting that far, and some post SP3
> > install are still getting stuck in the same way.
> >
> > it is random, in terms of who gets impacted but the impacted behavior is
> > consistant.
> >
> > "Shenan Stanley" wrote:
> >
> >> Asker of stupid questions wrote:
> >>> Posting this hoping that someone in the WIndows Update team is
> >>> aware of and looking at this problem. I am 100% sure there is a
> >>> new issue with servicehost.exe process taking 100% CPU. The
> >>> bahavior is similar but actually worse than the problem of a year
> >>> or so ago that was patched. This is a NEW issue.
> >>>
> >>> Since Tuesday a significant number of our customers (most are fully
> >>> up to date XP SP2, all flavors) are having issues with Windows
> >>> update taking 100% of CPU. On a single processor system the PC
> >>> goes to 100% CPU and never clears, we have left 2 systems over 5+
> >>> hours. On a hyper threaded or dual core CPU one thread runs the
> >>> one cpu to 100% but the remainder of the PC is stable. A
> >>> work-around is disabling auto-update.
> >>>
> >>> We have had 2 Vista systems showing similar behavior but not to the
> >>> same scale as XP BTW so something is clearly in need of review.
> >>>
> >>> It does not appear to be SP3 itself, nor does it appear to be a
> >>> latency/load issue on the WU servers. The PCs we have had this on
> >>> are all different OEMs, different ISPs, different sites etc. the
> >>> common thread is this one service that gets stuck and never clears,
> >>> unlike the similar issue a year ago that would eventually clear.
> >>>
> >>> MSFT, please get on top of this before it snowballs.
> >>
> >> One question - you stated, "most are fully up to date XP SP2, all
> >> flavors"
> >> then state, "It does not appear to be SP3 itself" <- do you mean it does
> >> not appear to be the attempted installation of SP3?
> >>
> >> I have not seen this issue on the few hundred I have running SP2+ all
> >> updates right before SP3 nor on the couple of hundred running SP3 - so...
> >> There must be more to this.
> >>
> >> --
> >> Shenan Stanley
> >> MS-MVP
> >> --
> >> How To Ask Questions The Smart Way
> >> http://www.catb.org/~esr/faqs/smart-questions.html
>
>

This started happening to my XP Home SP2 notebook last week. It's not on a
domain (although I have a small home-network). Basically, an instance of
SVCHOST.EXE would run up to 100% about 30-60 seconds after getting to my
desktop and it would start consuming memory until it hit > 100MB.

Ending the offending SVCHOST process disabled audio and networking.
Restarting the effected services does not fix the problem.

So basically my notebook was unusable.

Some forums posts from back in 2006 and 2007 pointed to Automatic Updates. I
install updates regularly (as they are available).

Using Process Explorer, I confirmed that Automatic Updates is the problem
and I disabled it using MSCONFIG. My CPU is now idling.

So some update that Microsoft recently pushed out is likely the cause of the
problem. I'm going to keep watching but for right now I am not going to
re-enable automatic updates.

Please begin a new thread about your problem.

shayward wrote:
> This started happening to my XP Home SP2 notebook last week. It's not on a
> domain (although I have a small home-network). Basically, an instance of
> SVCHOST.EXE would run up to 100% about 30-60 seconds after getting to my
> desktop and it would start consuming memory until it hit > 100MB.
>
> Ending the offending SVCHOST process disabled audio and networking.
> Restarting the effected services does not fix the problem.
>
> So basically my notebook was unusable.
>
> Some forums posts from back in 2006 and 2007 pointed to Automatic Updates.
> I
> install updates regularly (as they are available).
>
> Using Process Explorer, I confirmed that Automatic Updates is the problem
> and I disabled it using MSCONFIG. My CPU is now idling.
>
> So some update that Microsoft recently pushed out is likely the cause of
> the
> problem. I'm going to keep watching but for right now I am not going to
> re-enable automatic updates.

Very interesting and agree this is a new issue. My issues start about the
same time when XP SP3 auto update showed up. The auto update never finished
and resulted in the 100% of svchost.exe (windows update). Searched the web
for fixes and got suggestion, but none work so far. And everytime I go to
windows update site and run the check, with 30-60 seconds, my CPM maxes out.

So what is the fix for this issue?
Ron D.

"Asker of stupid questions" wrote:

> Posting this hoping that someone in the WIndows Update team is aware of and
> looking at this problem. I am 100% sure there is a new issue with
> servicehost.exe process taking 100% CPU. The bahavior is similar but
> actually worse than the problem of a year or so ago that was patched. This
> is a NEW issue.
>
> Since Tuesday a significant number of our customers (most are fully up to
> date XP SP2, all flavors) are having issues with Windows update taking 100%
> of CPU. On a single processor system the PC goes to 100% CPU and never
> clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
> core CPU one thread runs the one cpu to 100% but the remainder of the PC is
> stable. A work-around is disabling auto-update.
>
> We have had 2 Vista systems showing similar behavior but not to the same
> scale as XP BTW so something is clearly in need of review.
>
> It does not appear to be SP3 itself, nor does it appear to be a latency/load
> issue on the WU servers. The PCs we have had this on are all different OEMs,
> different ISPs, different sites etc. the common thread is this one service
> that gets stuck and never clears, unlike the similar issue a year ago that
> would eventually clear.
>
> MSFT, please get on top of this before it snowballs.

CA Antivirus has been identified as one of the causes of the CPU
utilization issue. It was either an updated DAT or engine update that
causes this. Configure CA to not scan .msi and .msp files for now and
hope that CA issues a less troublesome DAT/engine update:

http://forums.microsoft.com/technet/...&tf=0&pageid=1

> Have just got off talking to a CA technician. Was advised to exclude all *.msp and *.msi files in
the Real-Time scan.
>
> What I did was:
>
> 1. "Open Security Center"
>
> 2. "Open Advance Settings"
>
> 3. Clicked on the "Options" button
>
> 4. Clicked on the "Modify" link under the Exclusions list and then "Added" *.msi and *.msp to the
> list and clicked OK

For other systems where SP3 has been applied and the issue is occurring
without CA being present, suggest downloading and installing the latest
Version of the Windows Update Agent.

Links to the WUA and instructions on installing it can be viewed here:
http://www.bleepingcomputer.com/blog...showentry=1172


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Ron D. wrote:

> Very interesting and agree this is a new issue. My issues start about the
> same time when XP SP3 auto update showed up. The auto update never finished
> and resulted in the 100% of svchost.exe (windows update). Searched the web
> for fixes and got suggestion, but none work so far. And everytime I go to
> windows update site and run the check, with 30-60 seconds, my CPM maxes out.
>
> So what is the fix for this issue?
> Ron D.
>
> "Asker of stupid questions" wrote:
>
>
>>Posting this hoping that someone in the WIndows Update team is aware of and
>>looking at this problem. I am 100% sure there is a new issue with
>>servicehost.exe process taking 100% CPU. The bahavior is similar but
>>actually worse than the problem of a year or so ago that was patched. This
>>is a NEW issue.
>>
>>Since Tuesday a significant number of our customers (most are fully up to
>>date XP SP2, all flavors) are having issues with Windows update taking 100%
>>of CPU. On a single processor system the PC goes to 100% CPU and never
>>clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
>>core CPU one thread runs the one cpu to 100% but the remainder of the PC is
>>stable. A work-around is disabling auto-update.
>>
>>We have had 2 Vista systems showing similar behavior but not to the same
>>scale as XP BTW so something is clearly in need of review.
>>
>>It does not appear to be SP3 itself, nor does it appear to be a latency/load
>>issue on the WU servers. The PCs we have had this on are all different OEMs,
>>different ISPs, different sites etc. the common thread is this one service
>>that gets stuck and never clears, unlike the similar issue a year ago that
>>would eventually clear.
>>
>>MSFT, please get on top of this before it snowballs.

I recently did a fresh reinstall of Win XP Pro with SP3
And I noticed the same 100% CPU utilization in svchost (Automatic Updates)
for 1~2 minutes every now and then.
I use Avira AntiVir Personal & Spybot's TeaTimer - any known interactions
with WU ?
I can try disabling Teatimer, but I would like to avoid removing Avira
(and/or replacing it with another AV).

Thanks

"MowGreen [MVP]" wrote:

> CA Antivirus has been identified as one of the causes of the CPU
> utilization issue. It was either an updated DAT or engine update that
> causes this. Configure CA to not scan .msi and .msp files for now and
> hope that CA issues a less troublesome DAT/engine update:
>
> http://forums.microsoft.com/technet/...&tf=0&pageid=1
>
> > Have just got off talking to a CA technician. Was advised to exclude all *.msp and *.msi files in
> the Real-Time scan.
> >
> > What I did was:
> >
> > 1. "Open Security Center"
> >
> > 2. "Open Advance Settings"
> >
> > 3. Clicked on the "Options" button
> >
> > 4. Clicked on the "Modify" link under the Exclusions list and then "Added" *.msi and *.msp to the
> > list and clicked OK
>
> For other systems where SP3 has been applied and the issue is occurring
> without CA being present, suggest downloading and installing the latest
> Version of the Windows Update Agent.
>
> Links to the WUA and instructions on installing it can be viewed here:
> http://www.bleepingcomputer.com/blog...showentry=1172
>
>
> MowGreen [MVP 2003-2008]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> Ron D. wrote:
>
> > Very interesting and agree this is a new issue. My issues start about the
> > same time when XP SP3 auto update showed up. The auto update never finished
> > and resulted in the 100% of svchost.exe (windows update). Searched the web
> > for fixes and got suggestion, but none work so far. And everytime I go to
> > windows update site and run the check, with 30-60 seconds, my CPM maxes out.
> >
> > So what is the fix for this issue?
> > Ron D.
> >
> > "Asker of stupid questions" wrote:
> >
> >
> >>Posting this hoping that someone in the WIndows Update team is aware of and
> >>looking at this problem. I am 100% sure there is a new issue with
> >>servicehost.exe process taking 100% CPU. The bahavior is similar but
> >>actually worse than the problem of a year or so ago that was patched. This
> >>is a NEW issue.
> >>
> >>Since Tuesday a significant number of our customers (most are fully up to
> >>date XP SP2, all flavors) are having issues with Windows update taking 100%
> >>of CPU. On a single processor system the PC goes to 100% CPU and never
> >>clears, we have left 2 systems over 5+ hours. On a hyper threaded or dual
> >>core CPU one thread runs the one cpu to 100% but the remainder of the PC is
> >>stable. A work-around is disabling auto-update.
> >>
> >>We have had 2 Vista systems showing similar behavior but not to the same
> >>scale as XP BTW so something is clearly in need of review.
> >>
> >>It does not appear to be SP3 itself, nor does it appear to be a latency/load
> >>issue on the WU servers. The PCs we have had this on are all different OEMs,
> >>different ISPs, different sites etc. the common thread is this one service
> >>that gets stuck and never clears, unlike the similar issue a year ago that
> >>would eventually clear.
> >>
> >>MSFT, please get on top of this before it snowballs.
>

Were both AntiVir and Tea Timer enabled when you installed SP3?

benoitm wrote:
> I recently did a fresh reinstall of Win XP Pro with SP3
> And I noticed the same 100% CPU utilization in svchost (Automatic Updates)
> for 1~2 minutes every now and then.
> I use Avira AntiVir Personal & Spybot's TeaTimer - any known interactions
> with WU ?
> I can try disabling Teatimer, but I would like to avoid removing Avira
> (and/or replacing it with another AV).
>
> Thanks
>
> "MowGreen [MVP]" wrote:
>
>> CA Antivirus has been identified as one of the causes of the CPU
>> utilization issue. It was either an updated DAT or engine update that
>> causes this. Configure CA to not scan .msi and .msp files for now and
>> hope that CA issues a less troublesome DAT/engine update:
>>
>> http://forums.microsoft.com/technet/...&tf=0&pageid=1
>>
>>> Have just got off talking to a CA technician. Was advised to exclude
>>> all
>>> *.msp and *.msi files in the Real-Time scan.
>>>
>>> What I did was:
>>>
>>> 1. "Open Security Center"
>>>
>>> 2. "Open Advance Settings"
>>>
>>> 3. Clicked on the "Options" button
>>>
>>> 4. Clicked on the "Modify" link under the Exclusions list and then
>>> "Added" *.msi and *.msp to the list and clicked OK
>>
>> For other systems where SP3 has been applied and the issue is occurring
>> without CA being present, suggest downloading and installing the latest
>> Version of the Windows Update Agent.
>>
>> Links to the WUA and instructions on installing it can be viewed here:
>> http://www.bleepingcomputer.com/blog...showentry=1172
>>
>>
>> MowGreen [MVP 2003-2008]
>> ===============
>> *-343-* FDNY
>> Never Forgotten
>> ===============
>>
>>
>>
>> Ron D. wrote:
>>
>>> Very interesting and agree this is a new issue. My issues start about
>>> the
>>> same time when XP SP3 auto update showed up. The auto update never
>>> finished
>>> and resulted in the 100% of svchost.exe (windows update). Searched the
>>> web
>>> for fixes and got suggestion, but none work so far. And everytime I go
>>> to
>>> windows update site and run the check, with 30-60 seconds, my CPM maxes
>>> out.
>>>
>>> So what is the fix for this issue?
>>> Ron D.
>>>
>>> "Asker of stupid questions" wrote:
>>>
>>>
>>>> Posting this hoping that someone in the WIndows Update team is aware of
>>>> and looking at this problem. I am 100% sure there is a new issue with
>>>> servicehost.exe process taking 100% CPU. The bahavior is similar but
>>>> actually worse than the problem of a year or so ago that was patched.
>>>> This is a NEW issue.
>>>>
>>>> Since Tuesday a significant number of our customers (most are fully up
>>>> to
>>>> date XP SP2, all flavors) are having issues with Windows update taking
>>>> 100% of CPU. On a single processor system the PC goes to 100% CPU and
>>>> never clears, we have left 2 systems over 5+ hours. On a hyper
>>>> threaded
>>>> or dual core CPU one thread runs the one cpu to 100% but the remainder
>>>> of the PC is stable. A work-around is disabling auto-update.
>>>>
>>>> We have had 2 Vista systems showing similar behavior but not to the
>>>> same
>>>> scale as XP BTW so something is clearly in need of review.
>>>>
>>>> It does not appear to be SP3 itself, nor does it appear to be a
>>>> latency/load issue on the WU servers. The PCs we have had this on are
>>>> all different OEMs, different ISPs, different sites etc. the common
>>>> thread is this one service that gets stuck and never clears, unlike the
>>>> similar issue a year ago that would eventually clear.
>>>>
>>>> MSFT, please get on top of this before it snowballs.

No, I installed SP3 very early in the software installation process, and
certainly before AntiVir or Tea Timer were installed.

In the meantime, I discovered that manually accessing the WU site causes the
same symptom. I will try to access the WU site with AntiVir & Tea Timer
disabled ASAP & post the result here.

"PA Bear [MS MVP]" wrote:

> Were both AntiVir and Tea Timer enabled when you installed SP3?
>
> benoitm wrote:
> > I recently did a fresh reinstall of Win XP Pro with SP3
> > And I noticed the same 100% CPU utilization in svchost (Automatic Updates)
> > for 1~2 minutes every now and then.
> > I use Avira AntiVir Personal & Spybot's TeaTimer - any known interactions
> > with WU ?
> > I can try disabling Teatimer, but I would like to avoid removing Avira
> > (and/or replacing it with another AV).
> >
> > Thanks
> >
> > "MowGreen [MVP]" wrote:
> >
> >> CA Antivirus has been identified as one of the causes of the CPU
> >> utilization issue. It was either an updated DAT or engine update that
> >> causes this. Configure CA to not scan .msi and .msp files for now and
> >> hope that CA issues a less troublesome DAT/engine update:
> >>
> >> http://forums.microsoft.com/technet/...&tf=0&pageid=1
> >>
> >>> Have just got off talking to a CA technician. Was advised to exclude
> >>> all
> >>> *.msp and *.msi files in the Real-Time scan.
> >>>
> >>> What I did was:
> >>>
> >>> 1. "Open Security Center"
> >>>
> >>> 2. "Open Advance Settings"
> >>>
> >>> 3. Clicked on the "Options" button
> >>>
> >>> 4. Clicked on the "Modify" link under the Exclusions list and then
> >>> "Added" *.msi and *.msp to the list and clicked OK
> >>
> >> For other systems where SP3 has been applied and the issue is occurring
> >> without CA being present, suggest downloading and installing the latest
> >> Version of the Windows Update Agent.
> >>
> >> Links to the WUA and instructions on installing it can be viewed here:
> >> http://www.bleepingcomputer.com/blog...showentry=1172
> >>
> >>
> >> MowGreen [MVP 2003-2008]
> >> ===============
> >> *-343-* FDNY
> >> Never Forgotten
> >> ===============
> >>
> >>
> >>
> >> Ron D. wrote:
> >>
> >>> Very interesting and agree this is a new issue. My issues start about
> >>> the
> >>> same time when XP SP3 auto update showed up. The auto update never
> >>> finished
> >>> and resulted in the 100% of svchost.exe (windows update). Searched the
> >>> web
> >>> for fixes and got suggestion, but none work so far. And everytime I go
> >>> to
> >>> windows update site and run the check, with 30-60 seconds, my CPM maxes
> >>> out.
> >>>
> >>> So what is the fix for this issue?
> >>> Ron D.
> >>>
> >>> "Asker of stupid questions" wrote:
> >>>
> >>>
> >>>> Posting this hoping that someone in the WIndows Update team is aware of
> >>>> and looking at this problem. I am 100% sure there is a new issue with
> >>>> servicehost.exe process taking 100% CPU. The bahavior is similar but
> >>>> actually worse than the problem of a year or so ago that was patched.
> >>>> This is a NEW issue.
> >>>>
> >>>> Since Tuesday a significant number of our customers (most are fully up
> >>>> to
> >>>> date XP SP2, all flavors) are having issues with Windows update taking
> >>>> 100% of CPU. On a single processor system the PC goes to 100% CPU and
> >>>> never clears, we have left 2 systems over 5+ hours. On a hyper
> >>>> threaded
> >>>> or dual core CPU one thread runs the one cpu to 100% but the remainder
> >>>> of the PC is stable. A work-around is disabling auto-update.
> >>>>
> >>>> We have had 2 Vista systems showing similar behavior but not to the
> >>>> same
> >>>> scale as XP BTW so something is clearly in need of review.
> >>>>
> >>>> It does not appear to be SP3 itself, nor does it appear to be a
> >>>> latency/load issue on the WU servers. The PCs we have had this on are
> >>>> all different OEMs, different ISPs, different sites etc. the common
> >>>> thread is this one service that gets stuck and never clears, unlike the
> >>>> similar issue a year ago that would eventually clear.
> >>>>
> >>>> MSFT, please get on top of this before it snowballs.
>
>

I posted about this problem earlier and since then the MS tech contacted me
with a solution and it seems to have worked. (BTW, another online discussion
indicates that this could also be connected to the CA antivirus software that
I use.) At anyrate, here is what the MS tech told me to do...

Step 1: Prepare a Clean Boot environment.

==================================

Before we do so, please first enable the Windows Firewall:



a. Click "Start", click "Run", type "WSCUI.CPL" then click OK. This will
generate the Windows Security Center application.

b. In the Windows Security Center window, click Windows Firewall.

c. Select the option "On (recommended)" to turn on Windows Firewall.



1. Click Start and Click Run, and in the "Open" line, type in "MSCONFIG"
(without the quotation marks) and click OK.

2. Under the Service tab, check "Hide All Microsoft Services", and then
click "Disable All" button. In this way, we can disable all the services
which belong to third-party programs.

3. Under the Startup tab, click "Disable All" button.

4. Click OK.

5. Choose Yes to restart the computer.

6. Check "Don't show this message or launch the system configuration utility
when Windows starts".



Step 2: Rename the temporary folder of Windows Update.

============================================

1. Click Start, click Run, and type "cmd" (without the quotes) and press
Enter. Please run the following command in the opened window to stop the
Automatic Updates service.



Type in "net stop WuAuServ" (without the quotes) and press Enter.



Note: Please look at the cmd window and make sure it says that it was
successfully stopped before we try to rename the folder. However, if it
failed, please let me know before performing any further steps and include
any error messages you may have received when it failed.



2. Click Start, click Run, and type in "%windir%" (without the quotes) and
press Enter.

3. In the opened folder, look for the folder named "SoftwareDistribution".

4. Right-click on the folder, select Rename and type "SDold" (without the
quotes) to rename this folder.

5. Click Start, click Run, and type "cmd" (without the quotes) and press
Enter.



Type the command "net start WuAuServ" (without the quotes) in the opened
window to restart the Automatic Updates service.



Note: Please look at the cmd window and make sure it says that it was
successfully started. However, if it failed, please let me know before
performing any further steps and include any error messages you may have
received when it failed.



Step 3: Visit the Windows Update site.

==============================

Open Internet Explorer, and click Tools-> Windows Update to install Windows
Update from the website again. If the issue persists, please capture a
screenshot when the issue occurs, and send the picture file to me for further
research.


After we install the updates successfully, please return to the Normal
Startup.



1. Click Start, click Run, and in the "Open" line, type in MSCONFIG and
click OK.

2. Choose "Normal Startup" and then click OK.

3. Restart the computer.



Please test the issue again via the Windows Update website and let me know
the result. If the issue persists, to clarify the issue and provide more
accurate troubleshooting steps, please assist me in collecting the following
information.

>>> And I noticed the same 100% CPU utilization in svchost (Automatic
>>> Updates)
>>> for 1~2 minutes every now and then.

Every now and then is not unusual; prolonged or unending spikes of 100% are
not.

benoitm wrote:
> No, I installed SP3 very early in the software installation process, and
> certainly before AntiVir or Tea Timer were installed.
>
> In the meantime, I discovered that manually accessing the WU site causes
> the
> same symptom. I will try to access the WU site with AntiVir & Tea Timer
> disabled ASAP & post the result here.
>
> "PA Bear [MS MVP]" wrote:
>
>> Were both AntiVir and Tea Timer enabled when you installed SP3?
>>
>> benoitm wrote:
>>> I recently did a fresh reinstall of Win XP Pro with SP3
>>> And I noticed the same 100% CPU utilization in svchost (Automatic
>>> Updates)
>>> for 1~2 minutes every now and then.
>>> I use Avira AntiVir Personal & Spybot's TeaTimer - any known
>>> interactions
>>> with WU ?
>>> I can try disabling Teatimer, but I would like to avoid removing Avira
>>> (and/or replacing it with another AV).
>>>
>>> Thanks
>>>
>>> "MowGreen [MVP]" wrote:
>>>
>>>> CA Antivirus has been identified as one of the causes of the CPU
>>>> utilization issue. It was either an updated DAT or engine update that
>>>> causes this. Configure CA to not scan .msi and .msp files for now and
>>>> hope that CA issues a less troublesome DAT/engine update:
>>>>
>>>> http://forums.microsoft.com/technet/...&tf=0&pageid=1
>>>>
>>>>> Have just got off talking to a CA technician. Was advised to exclude
>>>>> all
>>>>> *.msp and *.msi files in the Real-Time scan.
>>>>>
>>>>> What I did was:
>>>>>
>>>>> 1. "Open Security Center"
>>>>>
>>>>> 2. "Open Advance Settings"
>>>>>
>>>>> 3. Clicked on the "Options" button
>>>>>
>>>>> 4. Clicked on the "Modify" link under the Exclusions list and then
>>>>> "Added" *.msi and *.msp to the list and clicked OK
>>>>
>>>> For other systems where SP3 has been applied and the issue is occurring
>>>> without CA being present, suggest downloading and installing the latest
>>>> Version of the Windows Update Agent.
>>>>
>>>> Links to the WUA and instructions on installing it can be viewed here:
>>>> http://www.bleepingcomputer.com/blog...showentry=1172
>>>>
>>>>
>>>> MowGreen [MVP 2003-2008]
>>>> ===============
>>>> *-343-* FDNY
>>>> Never Forgotten
>>>> ===============
>>>>
>>>>
>>>>
>>>> Ron D. wrote:
>>>>
>>>>> Very interesting and agree this is a new issue. My issues start about
>>>>> the
>>>>> same time when XP SP3 auto update showed up. The auto update never
>>>>> finished
>>>>> and resulted in the 100% of svchost.exe (windows update). Searched
>>>>> the
>>>>> web
>>>>> for fixes and got suggestion, but none work so far. And everytime I go
>>>>> to
>>>>> windows update site and run the check, with 30-60 seconds, my CPM
>>>>> maxes
>>>>> out.
>>>>>
>>>>> So what is the fix for this issue?
>>>>> Ron D.
>>>>>
>>>>> "Asker of stupid questions" wrote:
>>>>>
>>>>>
>>>>>> Posting this hoping that someone in the WIndows Update team is aware
>>>>>> of
>>>>>> and looking at this problem. I am 100% sure there is a new issue
>>>>>> with
>>>>>> servicehost.exe process taking 100% CPU. The bahavior is similar but
>>>>>> actually worse than the problem of a year or so ago that was patched.
>>>>>> This is a NEW issue.
>>>>>>
>>>>>> Since Tuesday a significant number of our customers (most are fully
>>>>>> up
>>>>>> to
>>>>>> date XP SP2, all flavors) are having issues with Windows update
>>>>>> taking
>>>>>> 100% of CPU. On a single processor system the PC goes to 100% CPU
>>>>>> and
>>>>>> never clears, we have left 2 systems over 5+ hours. On a hyper
>>>>>> threaded
>>>>>> or dual core CPU one thread runs the one cpu to 100% but the
>>>>>> remainder
>>>>>> of the PC is stable. A work-around is disabling auto-update.
>>>>>>
>>>>>> We have had 2 Vista systems showing similar behavior but not to the
>>>>>> same
>>>>>> scale as XP BTW so something is clearly in need of review.
>>>>>>
>>>>>> It does not appear to be SP3 itself, nor does it appear to be a
>>>>>> latency/load issue on the WU servers. The PCs we have had this on
>>>>>> are
>>>>>> all different OEMs, different ISPs, different sites etc. the common
>>>>>> thread is this one service that gets stuck and never clears, unlike
>>>>>> the
>>>>>> similar issue a year ago that would eventually clear.
>>>>>>
>>>>>> MSFT, please get on top of this before it snowballs.

Thanks Paul.

These instructions will work.

I used the instructions posted previously by DVO in a past thread. It's
slightly faster than the instructions from the Microsoft Technician.

---------------------------------
Execute each of the following commands from the command prompt
(Start->Run->cmd [enter]):

regsvr32 MSXML3.dll
regsvr32 WUAUENG1.dll
regsvr32 WUAPI.DLL
regsvr32 WUAUENG.DLL
regsvr32 WUAUENG1.DLL
regsvr32 ATL.DLL
regsvr32 WUCLTUI.DLL
regsvr32 WUPS.DLL
regsvr32 WUPS2.DLL
regsvr32 WUWEB.DLL
net stop WuAuServ
rename %windir%\SoftwareDistribution SoftwareDistribution_buggy
net start WuAuServ
--------------

I've had this issue occur on two friends' computers and have been able to
fix it by executing the above commands. The issue seems to have coincided
with the release of XP SP3 and unfortunately installing SP3 does not solve
the issue.

Cheers

"Paul142857" wrote:

> I posted about this problem earlier and since then the MS tech contacted me
> with a solution and it seems to have worked. (BTW, another online discussion
> indicates that this could also be connected to the CA antivirus software that
> I use.) At anyrate, here is what the MS tech told me to do...
>
> Step 1: Prepare a Clean Boot environment.
>
> ==================================
>
> Before we do so, please first enable the Windows Firewall:
>
>
>
> a. Click "Start", click "Run", type "WSCUI.CPL" then click OK. This will
> generate the Windows Security Center application.
>
> b. In the Windows Security Center window, click Windows Firewall.
>
> c. Select the option "On (recommended)" to turn on Windows Firewall.
>
>
>
> 1. Click Start and Click Run, and in the "Open" line, type in "MSCONFIG"
> (without the quotation marks) and click OK.
>
> 2. Under the Service tab, check "Hide All Microsoft Services", and then
> click "Disable All" button. In this way, we can disable all the services
> which belong to third-party programs.
>
> 3. Under the Startup tab, click "Disable All" button.
>
> 4. Click OK.
>
> 5. Choose Yes to restart the computer.
>
> 6. Check "Don't show this message or launch the system configuration utility
> when Windows starts".
>
>
>
> Step 2: Rename the temporary folder of Windows Update.
>
> ============================================
>
> 1. Click Start, click Run, and type "cmd" (without the quotes) and press
> Enter. Please run the following command in the opened window to stop the
> Automatic Updates service.
>
>
>
> Type in "net stop WuAuServ" (without the quotes) and press Enter.
>
>
>
> Note: Please look at the cmd window and make sure it says that it was
> successfully stopped before we try to rename the folder. However, if it
> failed, please let me know before performing any further steps and include
> any error messages you may have received when it failed.
>
>
>
> 2. Click Start, click Run, and type in "%windir%" (without the quotes) and
> press Enter.
>
> 3. In the opened folder, look for the folder named "SoftwareDistribution".
>
> 4. Right-click on the folder, select Rename and type "SDold" (without the
> quotes) to rename this folder.
>
> 5. Click Start, click Run, and type "cmd" (without the quotes) and press
> Enter.
>
>
>
> Type the command "net start WuAuServ" (without the quotes) in the opened
> window to restart the Automatic Updates service.
>
>
>
> Note: Please look at the cmd window and make sure it says that it was
> successfully started. However, if it failed, please let me know before
> performing any further steps and include any error messages you may have
> received when it failed.
>
>
>
> Step 3: Visit the Windows Update site.
>
> ==============================
>
> Open Internet Explorer, and click Tools-> Windows Update to install Windows
> Update from the website again. If the issue persists, please capture a
> screenshot when the issue occurs, and send the picture file to me for further
> research.
>
>
> After we install the updates successfully, please return to the Normal
> Startup.
>
>
>
> 1. Click Start, click Run, and in the "Open" line, type in MSCONFIG and
> click OK.
>
> 2. Choose "Normal Startup" and then click OK.
>
> 3. Restart the computer.
>
>
>
> Please test the issue again via the Windows Update website and let me know
> the result. If the issue persists, to clarify the issue and provide more
> accurate troubleshooting steps, please assist me in collecting the following
> information.
>
>
>
>