Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Windows XP - svchost.exe 50% CPU - wuauclt.exe - Help Please
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Windows XP - svchost.exe 50% CPU - wuauclt.exe - Help Please

Hello LET Members,

I would like your help.

We have a couple PC's that are having an issue installing updates. They are WinXP machines and they have all had a new image (re-installed).

When they are connected to the domain they work normally and receives group policy.

We have a WSUS server which gives out the Windows XP updates.

After a couple reboots the PC starts to run slowly as svchost.exe is using 50% CPU on the Dual-Core PC's and 25% on Quad.

wuauclt.exe is running under svchost.exe

The issue is that there seems to be nothing happening but it is killing the PC.

We have tried installing the Microsoft fixes for it but they are either already installed or the service pack is higher than the actual fix.

The PC starts to recieve updates after 2.5-3hrs of being on the network.

I found this on a Microsoft forum -
"My problem is solved now, it turned out to be a proxy issue again - damn proxy was redirecting requests for wsus-server to servers overseas instead of the one in the local subnet. Have solved it with an updated PAC file which stops any wsus-server requests going to the proxy and all is good now.
Appreciate the detail!"

We don't use PAC files as proxy settings are set via GP.

I am currently re-image the PC and will remove all proxy settings and see if the issue persists, I will also monitor traffic on this PC in/out to see if this comment above is the issue.

I would appreciate any tips or possible fixes.

Comments

  • have you install antivirus and scan your pc?

  • There are no viruses on the PC, it is a clean install + we install Antivirus and do a scan before joining the domain.

  • disabling windows automatic update.

    start menu > run > services.msc > automatic update (change from automatic to disabled)

  • @ramonwap said:
    disabling windows automatic update.

    start menu > run > services.msc > automatic update (change from automatic to disabled)

    This would be okay on a personal basis but this is within the Public Sector so disabling updates is a security risk.

  • mikhomikho Member, Host Rep

    A general solution to any problem related to Windows Update is to stop the Automatic Update service by starting services.msc from the Start >Run. After that rename the folder C:\Window\SoftwareDistribution and start the Automatic Update service again. Make sure that you visit http://update.microsoft.com/windowsupdate and run a scan for updates and install any critical updates. Restart and see if the problem remain.
    If that solves the problem, delete the renamed folder.

    On another note; you should no longer use Win XP in the public sector.

  • As @MikHo said, you NEED to be moving away from XP. It's dropping to EOL in April, and any significant migration won't be done by then. You need to start moving 3 months ago, AT LEAST.

  • @Magiobiwan said:
    As MikHo said, you NEED to be moving away from XP. It's dropping to EOL in April, and any significant migration won't be done by then. You need to start moving 3 months ago, AT LEAST.

    We are moving away from XP but the preparation for Win7 is taking a while. Over 500+ PC's.

  • The MikHo advice is the most common fix. You can script it:

    net stop “Automatic Updates”

    del /f /s /q %windir%\SoftwareDistribution*.*

    net start “Automatic Updates”

    wuauclt.exe /detectnow

    The underlining issue seems to be Microsoft stopping quality check on recent Windows xp updates (well, Exchange updates are not in a better shape, lately). As example, KB2879017 and KB2870699 appears to trigger the issue on some installations. As empirical findings, reinstalling IE8 and/or .net framework 3.5 could help. IE6 seems to greatly contribute to slowdowns.
    You will face significant challenges trying to support Windows xp in the coming months; mitigation steps may be required, such as deploy a separate wsus server for Windows xp clients, with a very selective update approval policy. It may be wiser to redirect most efforts to speed-up the Windows 7 / 8 migration.

  • SVCHOST.EXE runs at 100% CPU (Single Core) or 50% (Dual Core) or 25% (Quad Core)
    while attempting to run Automatic Updates under Windows XP

    I think this is a variation on this current (and recurring) issue:
    http://www.infoworld.com/t/microsoft-windows/windows-xp-update-locks-machines-svchost-redlined-100-fix-it-kb-2879017-230733

    This issue comes about because Windows Update is heavily reliant on components of Internet Explorer. If these components are not up-to-date, later versions of Windows Update Agent (that's the engine that scans for and manages updates) may fail or exhibit very poor performance.

    It is NOT necessary to install a new version of Internet Explorer to resolve this issue. What is actually required is to install the latest cumulative security update for whatever version of Internet Explorer you have installed. This will be IE6, IE7, or IE8 (if you're doing a fresh install of Windows XP it will naturally be IE6). This will upgrade the various components of your Internet Explorer installation. Thereafter Windows Update will perform as it should.

    The latest updates are dated November 2013 (as of writing this).
    Download and install the update that corresponds with your currently installed version of Internet Explorer:

    IE6: WindowsXP-KB2888505-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41064

    IE7: IE7-WindowsXP-KB2888505-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41071

    IE8: IE8-WindowsXP-KB2888505-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41074

    Recreating the Software Distribution folder doesn't fix the problem caused by this issue - but it will fix many other Automatic Update faults.

  • mikhomikho Member, Host Rep

    @dougcuk
    Not saying you are wrong but sometimes it helps deleting the Software Distribution folder, if the update fails to install.

  • I have the delete Software Distribution and Catroot2 folders fix stored as a script - and most times that fixes the problem. Normally the first thing I try!

    But when Windows Update just gets stuck checking for updates (automatic or manual) with svchost process at 100% and no error recorded in the Event Log - something else is wrong. Check the InfoWorld article I linked to for details of this issue - which sems to be occurring for many XP users at each monthly patch release. In the last 24 hours I had to fix 4 PC's with this problem resulting from the November patch release.

  • mikhomikho Member, Host Rep

    I don't use XP mysel and activly remove them from my customers by offering new hardware to a gold price and scare them abit on what might happen when time is up. :)

  • pcanpcan Member
    edited November 2013

    @dogcuk said: I had to fix 4 PC's with this problem resulting from the November patch release.

    Latest patch day is the worst in recent times, most Outlook 2013 users had issues. It is becoming worse every time and I wonder what will happens 10th december (next patch day). The new Microsoft motto should be: "we fix it until is broken".

    I found that the Internet explorer "refresh" you mentioned could fix the 100% CPU issue, but on my experience it only works sometimes and it will take time on older PCs. My fix is to clear the SoftwareDistribution folder. If it does not work, I reimagine the PC. No user data is on the local hard drive and the process is automated, so it is almost painless. We already migrated 99% of PCs to Windows 7, XP really is at the end of useful life.

  • Same temporary fix as last month:
    Download and install the latest Cumulative Security Update for Internet Explorer
    KB2898785 - December 10, 2013

    For Windows XP 32bit here are the direct download links:

    IE6: WindowsXP-KB2898785-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41458

    IE7: IE7-WindowsXP-KB2898785-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41442

    IE8: IE8-WindowsXP-KB2898785-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41404

    For full version listing see:
    MS13-097 Cumulative Security Update for Internet Explorer: December 10, 2013
    http://technet.microsoft.com/en-us/security/bulletin/ms13-097

  • cough linux

  • pcanpcan Member
    edited January 2014

    I resurrect this old tread for a update. Microsoft fixed the issue with the last montly update. This is a quote from a post on the Microsoft newsgroup:

    Issue Identified

    From the extended Windows Update logs, we saw the issue stemmed from inefficiencies in the Windows Update Agent processing long lists of superseded updates. And the problem was exponential in that each additional superseded item took twice as long as the previous item to evaluate. With lists as long as 40+ superseded items, the processing cost on SVCHOST via the Windows Update Agent had an exceptional impact on client PCs.

    Due to security requirements, the Internet Explorer product was required to continue building a chain longer than what is normally permitted in Windows Update. Over time, this exception exacerbated the previously unknown inefficiency in the Windows Update Agent.

    The fix changes the superseding evaluation logic, and most of the superseded IE updates have also been flagged as expired and removed from the evaluation chain.

    My tests have been limited but the issue seems to be indeed gone.

Sign In or Register to comment.