Regarding svchost slow down issues

[ArrrghBob]

We are having a problem with this issue on one particular motherboard type.
We have tried all the usual fixes, 927891, etc., deleting the contents of
c:\windows\SoftwareDistribution\DataStore. And finally turning Automatic
Updates completely off. The only that has worked on this particular machine
type is turning the AU off.

The motherboard we are working with is Intel D865GLC. It seems that this is
the only common denominator between the machines in our large computer lab
that work and those that don't. Does anyone know of an issue corresponding
to the svchost issue and the motherboard type?

Thanks,

Rob
--
Rob

"Eddies in the space/time continuum"
Ford Prefect

[MowGreen [MVP]]

It's *most likely* not the mobo, Rob. Did you install the latest version
of the Windows Update Agent ?
http://download.windowsupdate.com/v7...gent30-x86.exe

Is the installed antivirus scanning where it *shouldn't* be scanning :

Virus scanning recommendations for computers that are running Windows
Server 2003, Windows 2000, or Windows XP
http://support.microsoft.com/kb/822158

" For computers that are running Windows Server 2003, Windows 2000, or
Windows XP
Do not scan the following files and folders. These files are not at risk
of infection. If you scan these files, serious performance problems may
occur because of file locking. Where a specific set of files is
identified by name, exclude only those files instead of the whole
folder. Sometimes, the whole folder must be excluded. Do not exclude any
one of these based on the file name extension. For example, do not
exclude all files that have a .dit extension. Microsoft has no control
over other files that may use the same extensions as the following files.
• Microsoft Windows Update or Automatic Update related files
• The Windows Update or Automatic Update database file. This file is
located in the following folder:
%windir%\SoftwareDistribution\Datastore

Exclude the Datastore.edb file.

• The transaction log files. These files are located in the following
folder:
%windir%\SoftwareDistribution\Datastore\Logs
Exclude the following files:
• Edb*.log

Note The wildcard character indicates that there may be several files.
• Res1.log
• Res2.log
• Edb.chk
• Tmp.edb "

Svchost /MSI issue follow up
http://blogs.technet.com/wsus/archiv...follow-up.aspx

> Next steps for problem systems:
>
> If, after checking these installations, and reviewing expected behavior, iyou are still
> experiencing this issue and have a system which we can remote into, or obtain logs from,
> for further investigation, please contact me directly at bobbieh@microsoft.com. The
> windowsupdate.log from the system experiencing the performance issue would be helpful
> information as well as full system description of hardware, platform and additional
> programs installed and running.

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============



ArrrghBob wrote:

> We are having a problem with this issue on one particular motherboard type.
> We have tried all the usual fixes, 927891, etc., deleting the contents of
> c:\windows\SoftwareDistribution\DataStore. And finally turning Automatic
> Updates completely off. The only that has worked on this particular machine
> type is turning the AU off.
>
> The motherboard we are working with is Intel D865GLC. It seems that this is
> the only common denominator between the machines in our large computer lab
> that work and those that don't. Does anyone know of an issue corresponding
> to the svchost issue and the motherboard type?
>
> Thanks,
>
> Rob

[PA Bear]

Since your "usual fixes" didn't include installing Windows Update Agent 3.0,
v7.0.6000.374...

1. First install the newly released 'standalone' version of Windows Update
Agent 3.0, v7.0.6000.374
http://support.microsoft.com/kb/932494

Direct Download links:

x86-based versions of Windows (most users)
http://download.windowsupdate.com/v7...gent30-x86.exe

x64-based versions of Windows
http://download.windowsupdate.com/v7...gent30-x64.exe

Itanium-based versions of Windows
http://download.windowsupdate.com/v7...ent30-ia64.exe

2. Now reinstall this (updated) fix: http://support.microsoft.com/kb/927891

3. Reboot.

The MS update team believes that this solves all three svchost problems that
folks have been experiencing. See
http://blogs.technet.com/wsus/archiv...follow-up.aspx
and http://blogs.technet.com/wsus/archiv...update-on.aspx

Also see
http://www.bleepingcomputer.com/blog...showentry=1071
(First try the steps posted May 4th at the beginning of the article.)

Workaround: Change the default from Microsoft Update to Windows Update: Go
to Microsoft Update > Click on Change Settings in left pane > Scroll to
bottom of page > To Stop Using Microsoft Update > Disable Microsoft Update
software and let me use Windows Update only (check). cf.
http://support.microsoft.com/kb/901037

With Windows Update as your default, you will need to check in at Office
Update to keep your Office applications fully patched:
http://office.microsoft.com/en-us/do...incatalog.aspx
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org


ArrrghBob wrote:
> We are having a problem with this issue on one particular motherboard
> type.
> We have tried all the usual fixes, 927891, etc., deleting the contents of
> c:\windows\SoftwareDistribution\DataStore. And finally turning Automatic
> Updates completely off. The only that has worked on this particular
> machine
> type is turning the AU off.
>
> The motherboard we are working with is Intel D865GLC. It seems that this
> is
> the only common denominator between the machines in our large computer lab
> that work and those that don't. Does anyone know of an issue
> corresponding
> to the svchost issue and the motherboard type?
>
> Thanks,
>
> Rob

[ArrrghBob]

Thanks very much. It appears that this did fix our problem. As soon as we
excluded the special files from being scanned the system settled right down.

--
Rob

"Eddies in the space/time continuum"
Ford Prefect


"MowGreen [MVP]" wrote:

> It's *most likely* not the mobo, Rob. Did you install the latest version
> of the Windows Update Agent ?
> http://download.windowsupdate.com/v7...gent30-x86.exe
>
> Is the installed antivirus scanning where it *shouldn't* be scanning :
>
> Virus scanning recommendations for computers that are running Windows
> Server 2003, Windows 2000, or Windows XP
> http://support.microsoft.com/kb/822158
>
> " For computers that are running Windows Server 2003, Windows 2000, or
> Windows XP
> Do not scan the following files and folders. These files are not at risk
> of infection. If you scan these files, serious performance problems may
> occur because of file locking. Where a specific set of files is
> identified by name, exclude only those files instead of the whole
> folder. Sometimes, the whole folder must be excluded. Do not exclude any
> one of these based on the file name extension. For example, do not
> exclude all files that have a .dit extension. Microsoft has no control
> over other files that may use the same extensions as the following files.
> • Microsoft Windows Update or Automatic Update related files
> • The Windows Update or Automatic Update database file. This file is
> located in the following folder:
> %windir%\SoftwareDistribution\Datastore
>
> Exclude the Datastore.edb file.
>
> • The transaction log files. These files are located in the following
> folder:
> %windir%\SoftwareDistribution\Datastore\Logs
> Exclude the following files:
> • Edb*.log
>
> Note The wildcard character indicates that there may be several files.
> • Res1.log
> • Res2.log
> • Edb.chk
> • Tmp.edb "
>
> Svchost /MSI issue follow up
> http://blogs.technet.com/wsus/archiv...follow-up.aspx
>
> > Next steps for problem systems:
> >
> > If, after checking these installations, and reviewing expected behavior, iyou are still
> > experiencing this issue and have a system which we can remote into, or obtain logs from,
> > for further investigation, please contact me directly at bobbieh@microsoft.com. The
> > windowsupdate.log from the system experiencing the performance issue would be helpful
> > information as well as full system description of hardware, platform and additional
> > programs installed and running.
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
>
> ArrrghBob wrote:
>
> > We are having a problem with this issue on one particular motherboard type.
> > We have tried all the usual fixes, 927891, etc., deleting the contents of
> > c:\windows\SoftwareDistribution\DataStore. And finally turning Automatic
> > Updates completely off. The only that has worked on this particular machine
> > type is turning the AU off.
> >
> > The motherboard we are working with is Intel D865GLC. It seems that this is
> > the only common denominator between the machines in our large computer lab
> > that work and those that don't. Does anyone know of an issue corresponding
> > to the svchost issue and the motherboard type?
> >
> > Thanks,
> >
> > Rob
>

[ArrrghBob]

I really appreciate your quick response to my question. I tried the solution
on the post before yours and it worked, but I'm grateful for your help as
well.
--
Rob

"Eddies in the space/time continuum"
Ford Prefect


"PA Bear" wrote:

> Since your "usual fixes" didn't include installing Windows Update Agent 3.0,
> v7.0.6000.374...
>
> 1. First install the newly released 'standalone' version of Windows Update
> Agent 3.0, v7.0.6000.374
> http://support.microsoft.com/kb/932494
>
> Direct Download links:
>
> x86-based versions of Windows (most users)
> http://download.windowsupdate.com/v7...gent30-x86.exe
>
> x64-based versions of Windows
> http://download.windowsupdate.com/v7...gent30-x64.exe
>
> Itanium-based versions of Windows
> http://download.windowsupdate.com/v7...ent30-ia64.exe
>
> 2. Now reinstall this (updated) fix: http://support.microsoft.com/kb/927891
>
> 3. Reboot.
>
> The MS update team believes that this solves all three svchost problems that
> folks have been experiencing. See
> http://blogs.technet.com/wsus/archiv...follow-up.aspx
> and http://blogs.technet.com/wsus/archiv...update-on.aspx
>
> Also see
> http://www.bleepingcomputer.com/blog...showentry=1071
> (First try the steps posted May 4th at the beginning of the article.)
>
> Workaround: Change the default from Microsoft Update to Windows Update: Go
> to Microsoft Update > Click on Change Settings in left pane > Scroll to
> bottom of page > To Stop Using Microsoft Update > Disable Microsoft Update
> software and let me use Windows Update only (check). cf.
> http://support.microsoft.com/kb/901037
>
> With Windows Update as your default, you will need to check in at Office
> Update to keep your Office applications fully patched:
> http://office.microsoft.com/en-us/do...incatalog.aspx
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin; DTS-L.org
>
>
> ArrrghBob wrote:
> > We are having a problem with this issue on one particular motherboard
> > type.
> > We have tried all the usual fixes, 927891, etc., deleting the contents of
> > c:\windows\SoftwareDistribution\DataStore. And finally turning Automatic
> > Updates completely off. The only that has worked on this particular
> > machine
> > type is turning the AU off.
> >
> > The motherboard we are working with is Intel D865GLC. It seems that this
> > is
> > the only common denominator between the machines in our large computer lab
> > that work and those that don't. Does anyone know of an issue
> > corresponding
> > to the svchost issue and the motherboard type?
> >
> > Thanks,
> >
> > Rob
>
>

[PA Bear]

Way to go, ~BroMow! <eg>

ArrrghBob wrote:
> Thanks very much. It appears that this did fix our problem. As soon as
> we
> excluded the special files from being scanned the system settled right
> down.
>
>
>> It's *most likely* not the mobo, Rob. Did you install the latest version
>> of the Windows Update Agent ?
>> http://download.windowsupdate.com/v7...gent30-x86.exe
>>
>> Is the installed antivirus scanning where it *shouldn't* be scanning :
>>
>> Virus scanning recommendations for computers that are running Windows
>> Server 2003, Windows 2000, or Windows XP
>> http://support.microsoft.com/kb/822158
>>
>> " For computers that are running Windows Server 2003, Windows 2000, or
>> Windows XP
>> Do not scan the following files and folders. These files are not at risk
>> of infection. If you scan these files, serious performance problems may
>> occur because of file locking. Where a specific set of files is
>> identified by name, exclude only those files instead of the whole
>> folder. Sometimes, the whole folder must be excluded. Do not exclude any
>> one of these based on the file name extension. For example, do not
>> exclude all files that have a .dit extension. Microsoft has no control
>> over other files that may use the same extensions as the following files.
>> • Microsoft Windows Update or Automatic Update related files
>> • The Windows Update or Automatic Update database file. This file is
>> located in the following folder:
>> %windir%\SoftwareDistribution\Datastore
>>
>> Exclude the Datastore.edb file.
>>
>> • The transaction log files. These files are located in the following
>> folder:
>> %windir%\SoftwareDistribution\Datastore\Logs
>> Exclude the following files:
>> • Edb*.log
>>
>> Note The wildcard character indicates that there may be several files.
>> • Res1.log
>> • Res2.log
>> • Edb.chk
>> • Tmp.edb "
>>
>> Svchost /MSI issue follow up
>> http://blogs.technet.com/wsus/archiv...follow-up.aspx
>>
>>> Next steps for problem systems:
>>>
>>> If, after checking these installations, and reviewing expected behavior,
>>> iyou are still experiencing this issue and have a system which we can
>>> remote into, or obtain logs from, for further investigation, please
>>> contact me directly at bobbieh@microsoft.com. The windowsupdate.log from
>>> the system experiencing the performance issue would be helpful
>>> information as well as full system description of hardware, platform and
>>> additional programs installed and running.
>>
>> MowGreen [MVP 2003-2007]
>> ===============
>> *-343-* FDNY
>> Never Forgotten
>> ===============
>>
>>
>>
>> ArrrghBob wrote:
>>
>>> We are having a problem with this issue on one particular motherboard
>>> type.
>>> We have tried all the usual fixes, 927891, etc., deleting the contents
>>> of
>>> c:\windows\SoftwareDistribution\DataStore. And finally turning
>>> Automatic
>>> Updates completely off. The only that has worked on this particular
>>> machine
>>> type is turning the AU off.
>>>
>>> The motherboard we are working with is Intel D865GLC. It seems that
>>> this
>>> is
>>> the only common denominator between the machines in our large computer
>>> lab
>>> that work and those that don't. Does anyone know of an issue
>>> corresponding
>>> to the svchost issue and the motherboard type?
>>>
>>> Thanks,
>>>
>>> Rob