Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

svchost.exe using 100% CPU


  • This topic is locked This topic is locked
34 replies to this topic

#16 hamluis

hamluis

    Moderator


  • Moderator
  • 54,105 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:59 PM

Posted 12 December 2013 - 12:12 PM

I don't use auto updates...I just go directly to the Windows Update site, no need to auto-update.  That could be a factor, I don't know.

 

Louis



BC AdBot (Login to Remove)

 


m

#17 Marxamus

Marxamus

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:09:59 AM

Posted 12 December 2013 - 08:03 PM

The cause that I have found was windows updates, disabled the update service and stopped immediately.  It may be that since the death of win xp, the update server does not function correctly??  I have had this turned off for 3 days now and no more evidence of the issue.



#18 Taffy_078

Taffy_078

  • Members
  • 82 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:59 AM

Posted 14 December 2013 - 12:29 AM

The fix Microsoft say they are working on would be a change on their update servers not on the customers PC - so should not be a problem.  

 

 

Thanks for this, DougCuk. I think I understand now. I thought that the 100% svchost CPU problem was at my end, that as a result my PC wouldn't be able to get through but am I right in now thinking that the 100% CPU problem is actually happening after my PC has connected with their server because the problem is at their end?



#19 DougCuk

DougCuk

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London UK
  • Local time:12:59 AM

Posted 14 December 2013 - 07:13 AM

Assuming Microsoft have really isolated the cause of the problem - this would be the logic:

The 100% CPU overload is caused by the data your PC collects from the Microsoft server.

Specifically the overwhelming volume of possible Internet Explorer updates.

The Update service on XP is finding it difficult/impossible to sort through all the data to identify the required updates. 

 

But if you manually install the Latest Cumulative IE Update yourself the Update service finds Internet Explorer is fully updated and stops.

Seeing as the fix works (assuming you have no other Update issues) then it does appear to fit the basic facts.

 

It doesn't explain why most systems continued to work OK until summer/autumn this year and that some people seem unaffected.

And to be clear the problem also happens if you check the Windows/Microsoft Updates website direct - the same service is used.

It is just easier to abandon the attempt and kill the overload.

 

As I said previously:  Microsoft said they intended to fix this problem by pruning the IE updates database so that only the key Cumulative updates were offered when a search was initiated - this didn't happen in time for the November updated as intended - and obviously has not happened in time for the December update either! 
 



#20 DougCuk

DougCuk

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London UK
  • Local time:12:59 AM

Posted 14 December 2013 - 08:28 AM

Doug Neal from the Microsoft Updates team has posted an update here:
http://marc.info/?l=patchmanagement&m=138696900324972&w=2

 

The conclusion of his email is as follows:

 

While the underlying issue is with the WUA client, such a design change and rollout would take a lot longer and doesn't resolve the problem in the short term for those impacted now.

 

Attempted Fixes
As a result, we took what we believed were the right steps to expire large chunks of superseded (outdated, unnecessary) updates in the IE6 and IE7 supersedence lists.  Testing suggested this would be sufficient and we made the change on the backend in a release in October that expired these many unnecessary updates. 

 

Turns out the Windows Update Agent has smarts built into it that outsmarted us and the problem persisted for the majority of impacted customers.  We made a more comprehensive change in November and an even larger set of logic and expiration changes in December.  Unfortunately, the problem still wasn't solved.

 

Our customers have done a great job of letting us know the problem still hasn't been resolved. We appreciate the quick and detailed feedback.  And we share your frustration that we haven't been able to solve this for you more quickly.

 

We're working diligently to release changes to the supersedence logic that will comprehensively solve this problem.  It's a top priority.  And the right (and smartest) people are on it.  And as this problem has become more prevalent, we're working to provide a KB article that will publicly describe the issue so customers can discover it via searches and the recommended guidance.  Unfortunately, there is no 'fix' or quick workaround that can be applied at this time as we concurrently work to provide a backend fix and some guidance on the real, best solution.

 

I appreciate your patience.  And want to let you know we're working through the holiday to provide the right fix as soon as possible.  As you can imagine, we don't have an ETA.  And we want to make sure the next fix is the last and comprehensively solves this for our customers.

 

Doug Neal - Microsoft Update (MU)

 



#21 Taffy_078

Taffy_078

  • Members
  • 82 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:59 AM

Posted 14 December 2013 - 10:45 AM

Thanks DougCuk. I left my PC trying to search for updates at 09:13 today - it's 15:35 now. When I got back a few minutes ago there were twelve updates showing so I clicked on Instal. Hallelujah! (That's a technical term!) They've all installed!

 

My only problems now are

 

(1) one was an NVIDIA update that caused my screen to go about twice as large, not many colours or pixels - it's happened before and disappeared when I rebooted.

(2) my screen is currently 120% - to make things easier to view of course. But although the font on this post is said to be 14, it looks as if it's 4 or 6. I'll forget that for now.

(3) Winpatrol asked if I wanted to enable nwix.exe  There's a thread elsewhere here (http://www.bleepingcomputer.com/startups/nwiz.exe-3838.html   -   OMG this looks as if it font size 2!!!) but mine is nwix.exe/installquiet/keeploaded/nodetect. Should I start a new thread or can I assume it's Microsoft's and I need it?

 

Also, I rely on Windows Automatic Live Updates - am I safe to enable it again?


Edited by hamluis, 14 December 2013 - 12:30 PM.
Removed subscript - Hamluis.


#22 Taffy_078

Taffy_078

  • Members
  • 82 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:59 AM

Posted 14 December 2013 - 10:48 AM

Just seen my post above - the font is about half the size of DougCuk's!! But this one seems normal! Thank you Microsoft - without this c*ck-up, I would not have found Bleeping Computer!  :flowers:



#23 DougCuk

DougCuk

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London UK
  • Local time:12:59 AM

Posted 14 December 2013 - 12:33 PM

Slightly off topic Taffy_078 but for what it is worth here goes:

To be offered an nVidia Graphics driver update you must have selected it from the Optional Hardware Updates section.

The Optional Updates both Software and Hardware are not selected by default - you would have to tick boxes to select them.

The link you posted clearly states that nwix.exe is "Associated with the newer versions of nVidia graphics cards drivers".

 

As a rule I wouldn't install any of the Optional Hardware Updates offered by Windows/Microsoft Updates

It is always safest to get the correct update from the hardware manufacturer or the System builder (eg Dell, Toshiba) for your exact hardware.

It is well reported that the generic Microsoft hardware driver may not suit all versions of the hardware - especially if it is an older model.

And if you are experiencing no problems with the system it is best not to install new drivers - if it ain't broke don't try and fix it!!

 

Optional Software Updates are more of a judgement call - I tend to read what they are for and decide if I really want to install.

If you see no reason to install an optional update then keep things simple and ignore or hide them. 

 

You should now be able to re-enable Automatic Updates if you wish 

- or you could just use the Windows Update menu option to check manually that way you remain in control.

 

Unless Microsoft get this fixed before the next IE Cumulative Update is released the problem will happen again.

 


Edited by DougCuk, 14 December 2013 - 12:39 PM.


#24 Taffy_078

Taffy_078

  • Members
  • 82 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:59 AM

Posted 15 December 2013 - 02:39 AM

This is much appreciated! Thank you.


Edited by hamluis, 15 December 2013 - 11:44 AM.
Removed unnecessary quote - Hamluis.


#25 kureel

kureel

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 15 December 2013 - 08:05 PM

What a mess up this svchost issue is and what a waste of time. Thinking I had a serious malware/virus problem, spent time on doing thorough scans. Then decided to do sytem restore to previous dates, finally loading a previous image of system. All to no avail. Every time I connected to Internet, up comes 100% CPU usage for scvhost. Looked at various sites including microsoft"s but all info related to same SCVHOST issue in 2007. Turning off auto updates did not solve the problem.
Finally found that the cumulative sec update for IE8 KB2898785 cured the problem but if downloaded from microsift site, ( fortunately I had a second PC XP Pro which seems unaffected by the issue) it comes with an MSU extension. Instructions on instal from microsoft, click on file. Surprise, no program to open it. Why would microsoft not provide this ? Found a reference on how to expand and instal from .MSU but that did not work, probably my problem. So many thanks to DougCuk on 16 Nov for supplying an exe link which appears to be OK, currently downloading all updates since image made. Now to sort out the laptop which may have the same problem.
But what of the people who are not the slightest bit technically knowledgable ? Their only option is that having noticed their PC is a bit slow, for slow read unusable, is to go to a repairer who, if he is on the ball will know what has happened. If he has to go through the mill finding out, how much is that going to cost ? Microsoft, hang your head in shame for not testing your software properly and then for not keeping people informed that there was a serious problem. Thanks to Bleeping Computer and other sites for trying to resolve microsoft's problem. Cheers, kureel



#26 Taffy_078

Taffy_078

  • Members
  • 82 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:59 AM

Posted 16 December 2013 - 02:21 AM

well said, Kureel. Thanks goodness Microsoft don't make cars or planes,



#27 Kollin

Kollin

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:59 AM

Posted 17 December 2013 - 02:39 AM

Hi all

Gee, lucky I found this Googling. I've had the same problem since about September, steadily got worse, youtube stuttered, internet super-slow, last few days even typing was impossible.

Kept thinking it was Kaspersky taking too much RAM. Didn't look at the CPU column until yesterday... and there was SVCHOST at 99%.

Also noticed the Windows Update shield in the bottom-bar, stuck at 60% of download.

Solution... turned off Updates in the control panel, then blocked it in services.msc

Also downloaded and installed IE8: IE8-WindowsXP-KB2888505-x86-ENU.exe

This morning, all bright and sunny again.

 

A question... In order to fix this mega-bug, Microsoft will need to update all PCs running XP.

But any PC able to receive updates - i.e. where Updates hasn't been turned off - may be in a permanent state of freeze, and precisely because its able to receive updates.

Only PCs like mine, where Update has been disabled, will be... able to update.

Is this not a Catch-22 situation?



#28 DougCuk

DougCuk

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London UK
  • Local time:12:59 AM

Posted 17 December 2013 - 07:35 AM

The fix Microsoft say they are working on would be a change on their update servers
not on the customers PC - so should not be a problem.

 

For more see my post #13 on page one of this thread:
http://www.bleepingcomputer.com/forums/t/514140/svchostexe-using-100-cpu/#entry3231297

 

Also check post #20 above for the latest update from Doug Neal of the Microsoft Updates Team

(Post numbers eg #20 are displayed at the top right of each posting)

 

And you should now be using the December Cumulative IE8 Update

- as detailed in my post #11 - to avoid the XP Update bug:

 

IE8: IE8-WindowsXP-KB2898785-x86-ENU.exe
http://www.microsoft.com/en-us/download/details.aspx?id=41404

 

Happy Xmas All


Edited by DougCuk, 17 December 2013 - 07:41 AM.


#29 DougCuk

DougCuk

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London UK
  • Local time:12:59 AM

Posted 17 December 2013 - 05:11 PM

Ok for all those new to this thread here is a summary of the problem - plus one NEW complication:

 
The Windows Update service runs one CPU core at full throttle - so if you only have a slow single core CPU it runs at 100% and you can get nothing done - dual core (or hyperthreaded 2 cores) run at 50% and are slow - and quad cores run at 25% and you may not notice. What you see is a process called SVCHOST running at 100% (or 50%, 25%) this contains the Update service.

 

All the XP systems I have fixed (6 personally and many more via postings on several forums) are ALL using IE8 - so I think MS are seriously deluded if they think IE8 is not badly affected. The longest "freeze" I have seen was 6 hours and that was aborted at that point. In my experience the faster the PC and the more RAM you have the faster it battles through to a conclusion.
 
The simplest fix is to select "Turn off Automatic Updates" via the Control Panel icon - until the new year when MS may have fixed the logic on their Update server. Visiting the Windows/Microsoft Updates website using the XP "Windows Update" option will also trigger the same SVCHOST overload as it too uses the Windows Update service.
 
In all the cases I have seen when NOTHING else is screwed the temporary fix that has worked is to manually download and install the LATEST "Cumulative Security Update for IE8" (or IE7, IE6) - this stops Windows Update searching for ANY more IE updates - it side-steps the problem until next month.

 

One NEW complication I have identified - and reported to Microsoft Tech Support - is that one of the MS-Fix-It's that XP users are running (to try and fix Windows Update) is actually making the problem worse.

 

The Fix-It runs from KB971058 and is titled "How do I reset Windows Update components" and breaks BITS (Background Intelligent Transfer Service) - and without this service Windows Update will not run.

 

The BITS registry is modified with Win7 / Vista format entries that are incompatible with XP

- the BITS (service) gets renamed as "@%SystemRoot%\\system32\\qmgr.dll,-1000"

-plus a few other registry changes that disable the service.

 

Other Fix-It's for XP coded by the same idiot at MS may also exist. So not only do you have to understand the SVCHOST problem - but also work out how to fix the BITS registry!    Do an immediate System Restore is the only easy answer.

 

Happy Xmas All    


Edited by DougCuk, 18 December 2013 - 01:16 PM.


#30 lti

lti

  • Members
  • 580 posts
  • OFFLINE
  •  
  • Local time:05:59 PM

Posted 17 December 2013 - 10:56 PM

To be offered an nVidia Graphics driver update you must have selected it from the Optional Hardware Updates section.

The Optional Updates both Software and Hardware are not selected by default - you would have to tick boxes to select them.

 

I have seen Windows Update list drivers as required updates before. The two I saw were for an nVidia graphics card (an old GeForce 4 from 2003) and a Broadcom dial-up modem.


Edited by lti, 17 December 2013 - 10:57 PM.





2 user(s) are reading this topic

0 members, 2 guests, 0 anonymous users