Automatic Update causes SVCHOST.exe high CPU


Symptom

 

SVCHOST high CPU.  If stopping  the Automatic Update service, the high CPU issue disappears.

 

You can use the following method to verify whether it is AU caused SVCHOST high CPU.

 

1.       Run the command to find the PID of SVCHOST which is running on Automatic Update service.

Tasklist –m wuaueng.dll

 

2.       Run the command to enforce client to Automatic Update.  In certain circumstances, high CPU issue may recur after running the command.

Wuauclt /detectnow

 

3.       Find the PID of SVCHOST which is running on Automatic Update service, monitor and verify if it causes high CPU for long time. High CPU for short time is normal and is not a problem.

 

Solution

 

If Automatic Update causes SVCHOST.exe high CPU, please refer to the following KB articles:

 

http://support.microsoft.com/kb/916089/en

http://support.microsoft.com//kb/927891/en

 

You can try the following methods to resolve the issue.

 

1.       Install update KB927891

http://support.microsoft.com//kb/927891/en

 

2.       If client still encounters persistent 100%CPU issue after installing update KB927891, please download and install the latest WSUS 3.0 client:

 

32-bit versions

 

http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

 

64-bit version

 

http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x64.exe

http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-ia64.exe

 

The 2 updates (KB927891and WUA3.0 )to resolve AU related SVCHOST high CPU issue are available on WSUS now.

 

KB927891 is available on WindowsUpdate /WSUS. It is listed as Critical Updates in WSUS. Please refer to:

http://blogs.technet.com/wsus/archive/2007/05/22/latest-msi-dll-fix-927891-also-available-to-wu-wsus-today.aspx

 

KB936301 is listed in WSUS as Critical Updates. It is to install on WSUS 2.0 SP1 server to upgrade Selfupdate tree to “WSUS 3.0” but keep the server as WSUS 2.0, so that client can get WUA3.0 by visiting WSUS selfupdate tree. Please refer to:

http://blogs.technet.com/wsus/archive/2007/05/22/updates-for-wsus-available-today.aspx

 

Based on our monitoring and customers’ feedback, the above two steps are able to alleviate the Issue.

 

For the latest update about the issue, please refer to the following web site.

http://blogs.technet.com/wsus/archive/2007/04/28/update-on.aspx

 

If you have any question about the issue, please contact GCR PSS Security Support Group (shsecs@microsoft.com) to get further technical support.


 [v1]Is this supposed to be here?

Comments (57)

  1. Anonymous says:

    We’ve had this problem quite often with our 2003 servers. And we usually just bootet them, and the problem would solve it self. Tried to just disable and then stop the Automatic Updates service, and the CPU dropped instantly. Thanks!

  2. Anonymous says:

    Anon…thanks for posting that message. I had tried everything listed here so far and none of the suggestions worked until the one you listed. Now just have to wait for the 100 crit updates to install

  3. Anonymous says:

    I’ve written an article that has a potentially comprehensive fix to this issue.

    http://solotechpros.com/2014/01/08/windows-xp-svchost-exe-wuauclt-exe-cpu-100-fix/

  4. Anonymous says:

    Correcting my comment on page 2 (“Anonymous 19 Dec 2013 8:04 AM”) that renaming DataStore.edb worked for me, it resurfaced later down the line.

    What now seems to have worked for me for a couple/three days started with a comment above I think where Elohir pointed to http://technet.microsoft.com/en-us/security/bulletin/ms13-097 and the direct link on the page that I used for updating IE8 was http://www.microsoft.com/en-us/download/confirmation.aspx?id=41404.

    This is 32-bit XP SP3 and the IE version currently shows 8.0.6001.18702IC

    Right, so with Christmas today I’ll say here’s to a silent night methinks with computer fans sleeping all snug on their heat sinks.

  5. Anonymous says:

    Tank yous Sageadvice, uninstalling the office crap soved my issue. Damn Msft, learn coding please ! howx can office affect windows update that way … only explanation your code is a plate of spagetti !

  6. Anonymous says:

    This worked for me:

    ren “C:WINDOWSSoftwareDistributionDataStoreDataStore.edb” DataStore.edb.bak

  7. Anonymous says:

    Just reinstalled sp3 from disk and ended up with this bug. Was working great for years untill drive crash. Then reinstalled from my sp3 disk. No excuse for this I have the lastet sp3 on disk it used to work MS has done something to break it

  8. Anonymous says:

    Installing IE8 after a fresh install of server 2003 R2SP2 fixed my issue. After waiting hours for svchost taking 100% cpu, a 5 minute install fixes the issue. Letting another server sit all night finally worked too but who can wait all that time, time is money! Elohir might have a solution too because the patch referenced is included in the IE8 install (make sure you select download updates). Either way i am glad i found this thread to solve MS updates from wasting so much of my time. Would be great if MS would just release SP3 or a patch roll-up to apply after a fresh install.

  9. Anonymous says:

    Running XP pro SP3, FRESH INSTALL on my dell gx620 and still having this problem, Applied every fix I can think of, even the patch to IE8 found on this page and still svchost.exe runs at 50 % cpu constantly. (Its a dual core system so taking up a whole core to itself)

    I’ve read somewhere that if you run wireshark windows update constantly tries to contact a certain address, and that its kind of stuck in a loop because it cant connect. Not sure if its the same problem but mine is still not working.

    Any ideas guys?

  10. Anonymous says:

    Thank you Tcv! Your solution worked a charm.

  11. Anonymous says:

    As Elohir posted above:
    To fix the 100 % CPU usage of svchost.exe when using Microsoft Windows Update install the Cumulative Security Update for Internet Explorer 6, 7 , 8 9, 10 and 11 (MS KB 2898785) referenced in Microsoft Security Bulletin MS13-097 –
    http://technet.microsoft.com/en-us/security/bulletin/ms13-097 .

    (after you installed the patches mentioned in the original blog posting, of course)

  12. Don Etling says:

    Tried both patches with no success.  The only way I was able to get Windows Update to work was to reset my display driver to absolute minimum (640×480 – 16 colors).  The updates ran fine.  I haven’t had a chance yet to reset the resolution to something real to see if it still works.  Maybe something changed in your scrolling green bar?

  13. Draino says:

    I have found that either sometimes a computer has to stay on overnight before it will complete the scanning process. This is possibly due to either certain older (non dual-core) systems can’t cope with the massive CPU load that is generated by svchost.exe or the WSUS service can’t cope with more than a few client requests at once. Either way it takes on average 2 days to get a Windows XP system updated from a basic SP2 install… quite annoying since the users here expect a turnaround time of a few hours!

  14. tom says:

    Tried them all still the same issue.

    This seems to be caused by updating from WSUS 3.0 to WSUS 3.0 SP1.

    I have got some machines working killing all the update services processes and Deleting %windir%SoftwareDistribution, %windir%System32SoftwareDistribution, %windir%System32CatRoot and %windir%System32CatRoot2

    Ran the WindowsUpdateAgent30-x86.exe

    After the installation ran "wuauclt /detectnow"

    Let me know if there is a better solution for this….

  15. Sageadvice says:

    I ran the KB927891and WUA3.0 but the problem remained, although better thanit was. Tom’s solution clearing out %windir%SoftwareDistribution fixed the issue.  However, the cause is not clear.  In this case an update to the Genuine Windows Validation tool had occurred about 3 days before the issue started. On the 3rd day a Windows update was flagged to be installed on shutdown, which it was. On next boot the problem started.  My client’s other PC had the same Genuine Windows Validation tool update applied about a week later, and it too developed the problem 3 days later (ie a week after the first PC).

  16. Sageadvice says:

    Further to my earlier post I have now confirmed that the SVCHOST/update high CPU problem was caused by installing the Office 2007 converter pack which, on next boot, caused Office 2007 patch KB947801 to be installed. The high CPU use stared on next boot.  This process has been followed on a second PC with the same result.

  17. Chris says:

    I also used Tom’s solution to correct this annoying problem.  I am running Windows XP Professional with SP2 and all current updates as of 5/23/08.

    Thanks for the info Tom. Now to fix the rest of the PCs having this problem.  One thing I noticed is that it’s only happening to my Intel based systems. AMD doesn’t seem to be affected though I don’t know if that has anything to do with it.

  18. Paul Douglas Hale says:

    Thank you for you superior work!  You really put your heart into this and IT!

    I am running all soultions now!

    Best Regards

  19. Jeff25 says:

    This was happening for me with Auto and Manual updates for "Windows XP Mode" (virtual windows xp on windows 7. I tried everything I could find documented on fixing the issue to no avail. Upgrading IE 6 to IE 8 seems to have done the trick, now manual updates is actually working! Haven't thoroughly tested, but so far it seems promising 🙂

  20. DragosDogaru says:

    start–run–services.msc–automatic updates–properties–general–startup type.disabled–service status–stop–log on–profile1–disabled–ok

  21. Frank says:

    Jeff, you are awesome with that suggestion with WinXP in virtual mode. I have two machines that I have not updated in awhile and that was my holdup also with windows update just continuously running and never offering any updates! Downloaded ie8 from website after stopping automatic update service and once rebooted windows update now updating and installing updates, thanks!

  22. Al says:

    Just turn-off the Windows Automatic Update

    — Anyway Microsoft announced that their support foe WinXP will stop on April 2014

    — by the way , even now 15-November-2013  their downloading for WinXP  is not working

  23. sam says:

    Sure, lets just turn off automatic updates, uninstall Security Essentials, throw away thousands of dollars of our working software, convert our data and buy a new PC that can run Win H8TE and buy new software.  These are the kind of problems that you get when you let young people manage! This problem NEVER should have happened!!!  One day you have to reinstall your OS and suddenly you're screwed by the company you gave your money to. TOTALLY WRONG on so many levels!!!

  24. alex says:

    The contact shsecs@microsoft.com has been expired. This issue looks like something new with Windows Update. The WU team is looking into it. Suppose the fix will be in place soon.

  25. Glenn says:

    I have been a customer of Microsoft since the first version of Windows came out 28 years ago.  I had planned to buy a new PC during this Black Friday weekend and move from Windows XP SP3 to Windows 8 but have changed my mind about doing anything until I see if the Windows Update team will fix this svchost.exe 99% CPU problem, which appeared in my Dell Dimension 3000 after automatic updates in October. (Since support for XP SP3 will end on April 8, 2014 my gut feeling is that Microsoft has done something nefarious to get a lot of people to do what I was about to do.)

  26. tim villalobos says:

    I get the same issue with svchost running at 99% when I reloaded XP after slicking the disk.

    No other software on the disk except WinXP SP2, from the original install disk.  Tried running SP3 from a CD, still have problem.  Updated to IE 8, still have issues.

    Svchost runs at 99% of the CPU time.

    Cannot start or run the Firewall (or even start the service for it).  I think others have this issue but it may not be obvious.

    Have to turn off autoupdates or else svchost will eat up all of the cpu time, all of the time.

    Cannot run many Windows functions like IE because it will start a service host that will eat up all of the cpu time.

    Cannot run updater manually because once again, all cpu time is being eaten up.

    No viruses no malware. Have just reloaded directly from the original XP SP2 install disk.  SP3 did nothing to fix it.  Updating from IE6 to 8 changed nothing.  Loaded and ran both Security Essentials and malicious software removal tool and nothing both times.

    So the issue may not be an updater issue since mine is turned off.  Svchost at 99% fires up whenever I run IE8 or IE6 too.

    Also whatever it is, it prohibits me from being able to bring up the firewall or restarting the firewall service manually also.

    Like I said, that is not an obvious symptom, others may have that issue too but not know it.

    Whenever I run almost any program or function, it always fires up svchost and pegs it at 99%.

  27. Cormang says:

    We have numerous 2003 servers which are having this problem. SVCHOST.EXE uses up 100% of CPU and causes all critical applications to fail. We've tried everything mentioned in this article – no success.

  28. thomas says:

    we experience the same problem with 2003 servers. 100 % CPU with 1 CPU servers.

  29. Joe says:

    I saw this recently in an XP VM I use . I chased it down to the "Automatic Updates" service. Disabling the "Automatic Updates" service cured it. (Also disables Windows Update from doing Auto updates, but I can live with that for now.)

  30. GC says:

    We have the same issue, once updates are approved on WSUS our 2003 server go high cpu unstill the updates are actually installed, constant alerts on Nagios. WSUS client is 7.6.7600.256, 2008r2 servers are fine. KB927891 is already installed.

  31. KT says:

    svchost.exe 99%CPU started happening on three of my WinXPSP3 machines (two different offices) last nite.  (Win 7 PC has no problem.)  I disabled Automatic Update service using services.msc, and that fixed it.  MS or somebody must have sent some remote commands to all the XP Windows Update Agents recently.  I can't think of any other way to explain how all my XP machines in geographically different locations would start doing this simultaneously.

  32. GB says:

    svchost.exe 99%CPU started happening on 2 of my XP machines. Win 7 is fine. Turning off Auto updates fixed this soooo turning off auto $buy$ Win 8/9/10 will also fix future problems for me.

  33. tcv says:

    I've seen it reported that if you apply the cumulative update for the version of IE on your workstation or server, this problem goes away, at least for a month. I've done this on a x86 2003 server successfully tonight.

    Go to this link for the full security bulletin:

    technet.microsoft.com/…/ms13-097

    In that link, under Affected Operating Systems, look for your Operating System and your version of IE. The IE version is a link that will take you to the download page. Download and apply, then restart your Automatic Updates service and scan. I did not have to reboot my server after I applied the cumulative update but, of course, I had to reboot after applying the rest of the updates.

    Hope this helps.

  34. wej says:

    Thank you, tcv — your cited solution worked for me. I tried a number of other suggestions until finding yours; as soon as I applied the Cumulative Update for Internet Explorer and then rebooted the system wuauclt.exe is no longer hogging the CPU. Process Explorer shows 2 instances of wuauclt.exe currently active, but they are behaving themselves now!

  35. bartace says:

    Yes, thank you, tcv… manually downloading and installing that cumulative update helped me as well.  

    I've been dealing with this problem of svchost.exe -k netsvcs using up 100% of cpu for a few weeks now, running XP sp3 and IE8.  I figured out that I can stop the Automatic Updates service and everything seemed to calm down.  Kind of forgot about that last night and got frustrated enough to back up my files and reimage it.  Sat down this afternoon to install hardware drivers, SP3, IE8, antivirus and when I got to the point of downloading and installing critical updates it slowed to a crawl again.  The green bar just kept running on the update search and the processor fan started singing again.  Lo-and-behold svchost.exe was at 100% again.  I couldn't believe it.  Stopped the Automatic Update service and of course the update page errored out.  But the processor settled down again.  Popped the hard drive in another computer of the same model thinking it might be a hardware problem.  Of course it wasn't.  Even the older computer's hard drive, which hasn't been used in many months and was working ok when last used, exhibited the same problem and cleared up when I stopped the Automatic Updates service on it.  I did a little online searching from the old one while the green bar is still running for update search on the new one, found this thread and downloaded the cumulative update for XPsp3 and IE8 to a flash drive.  Popped it in the new one and stopped the Automatic Update service.  Installed the cumulative update on the new one and rebooted.  It is happily downloading and installing the first batch of 128 critical updates now and the cpu usage is bouncing around normally now.  It now has 2 instances of wuauclt.exe showing in Process Explorer under svchost.exe and behaving themselves, like wej said.  Keeping my fingers crossed that it stays happy.  

    Kind of hate that I pulled the trigger and rebuilt it last night if that cumulative update was all it needed.  But Automatic Update wasn’t working and it couldn’t find the cumulative update without it.  And I recall when it first stared happening a few weeks ago I didn’t have much luck searching for a solution to fix it.  I had reached the conclusion it must have been a malware problem that I had no desire to waste time fixing.  In my frustration last night I thought it was better to just blow it away and reload it.  Oh well, I got a fresh and speedy OS now even though that didn’t fix it.  

  36. Michele Testa says:

    Really thanks Tcv, it worked for me too. Manually downloading IE update and installing it resolved this annoying issue

  37. icsllc says:

    Anxious to try the update tcv mentions as I have been dealing with this issue for the better part of a week to no avail.  Here is the problem…the machine I most need to repair will not run the update!  I downloaded the update for XP SP3 IE8, but I get the following errors when trying to run it: "The system cannot find the file specified."  Then, "Installation did not complete."  HELP!

  38. Anonymous says:

    Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possible

  39. Anonymous says:

    Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possible | ShareMyKnowledge

  40. Anonymous says:

    Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possible | ShareMyKnowledge

  41. Anonymous says:

    Pingback from Microsoft to fix Windows XP SVCHOST redlining issue as soon as possible | ShareMyKnowledge

  42. Tommy Effer says:

    I had this problem after reformatting and doing a fresh install of XP SP3, found that if I first installed the “Micorosoft Update”, Windows update began working as expected with no other fixes.

  43. Tommy Effer says:

    I had this problem after reformatting and doing a fresh install of XP SP3, found that if I first installed the “Micorosoft Update”, Windows update began working as expected with no other fixes.

  44. dom says:

    Thank you Tcv, it works !

  45. Elohir says:

    If you are stil having this problem (or it is happening again) at the end of December, 2013, the latest patch to address this issue can be found here: http://technet.microsoft.com/en-us/security/bulletin/ms13-097

  46. twizzler says:

    tcv – Thanks, your idea about installing the cumulative update for IE worked! I rebooted the server after installing and then Windows Update worked fine and SVCHOST no longer used 100% of the CPU.

    “I’ve seen it reported that if you apply the cumulative update for the version of IE on your workstation or server, this problem goes away, at least for a month. I’ve done this on a x86 2003 server successfully tonight.

    Go to this link for the full security bulletin:

    http://technet.microsoft.com/en-us/security/bulletin/ms13-097

    In that link, under Affected Operating Systems, look for your Operating System and your version of IE. The IE version is a link that will take you to the download page.”

  47. Me says:

    No luck and WSUS installation encountered unrecoverable error and no go, normal and expected behaviour of Windows;) Re-install the whole BS.

  48. Surendra says:

    Our client is using Server 2003 R2 Standard edition SP2.

    Issue is svchost.exe – Generic host process for win32 services is using 95% of CPU.

    I extract svchost.exe and found wuaueng.dll is using morethan 90% CPU and we are unable to fix it(attached for ref).

    Requested you kindly provide me solution asap. Your quick response will be appreciated.

  49. Paul Stage says:

    Are there any updates on this issue? I have the same exact issue with Windows 2008 R2 Standard. Killing the Windows Update service is a workaround, but I would like the root cause eliminated.

  50. Kevin Ray says:

    I’m seeing the same issue on systems with a single CPU. This condition started after we installed updates from Feb, March, and April during our quarterly MS updates.

  51. Adam Zollenkopf says:

    Also getting the same thing. Server 2008 R2 Standard. Tried updating the update agent and clearing the SoftwareDistribution folder but it doesn’t help. At the moment the only choice I’ve got is to keep the service disabled.

  52. Dan_IT says:

    The KB links in this article are all dead. Does anyone still have copies of them or know if they apply to Server 2008 R2?

  53. Claude says:

    I went to the Resource Monitor –>CPY–>Services and could see that wuauserv (Windows Update) was the culprit using all of my CPU power. I right clicked on it Stop Service. The fan immediately stopped running and the CPU usage went down to 18-23%.