svchost.exe - Windows Update - 100% CPU Utilization fix (EASY)

[ralphie_boy]

:mrgreen: OK - my first post - took 12 hours but tenacity and refusal to"reformat an re-install" (per dell support) wins. I hope this saves someone a lot of pain and frustration. I figured there are a million posts on the problem - why not start a new post with just a solution that worked for me. so you won't have to read for an hour. also a link to a cool utility to monitor the processes on your machine is at the bottom.

Situation: CPU utilization would hit 100% with svchost.exe. Could not figure it out but saw that little shield letting me know Windows automatic update had updates for me to install. When you tried to install them it never happened because of the cpu utilization. If you went to microsoft.com to check for update it would not work/ microsoft updates hang on checking your computer for updates or error out.

Solution: in a nut shell: In Services - the service 'Automatic Updates' - says it is started but in reality it is not.

Resolution:
I am going to give you the fix now rather then at the end of a 200 line write up.

1) Reboot as normal - the moment you see your desktop hit cntrl - shift - esc all at once to bring up the windows task manager. You want it to load before cpu utilization hits 100%

2) When task manager opens click on the services tab to show the services and then click on the cpu column heading to sort the processes by cpu utilization - sort it so the process using the most cpu is on top and you can see it. svchost.exe will show itself there soon enough. (when it does just kill it - I know I will get grief for saying that but you have to because you cannot do anything else.... remember my system did a windows update or was at least trying to)

3) If you have the time and you are not yet hitting that 100% mark with svchost.exe, click Start - run -and type in "services.msc". when the services window loads sort the services by name a-z by clicking on that column heading.

4) find the service 'Automatic Updates' - my guess is it says STARTED and AUTOMATIC on this screen however - double click on it for more details - I will venture to guess in here it says STOPPED on the top even though the other screen says started. It may have even said started at the bottom third of the details screen as well - any how - it is a mismatch. Change this service to "Disabled" and hit apply - you may have to hit STOP (I do not remember but I think you do) when it says disabled and stopped click OK to close I also cannot remember if I rebooted here or not. I think I did but I don't think I needed to. If you do, you will have to go through the steps all over again, so I would try it first without rebooting.

5) On your list of services, find the service called "Background Intelligent Transfer Service" double click to verify but it should be set to Manual and stopped - if so click OK. If not change it to be so.

6) On your list of services, find the service called "Event Log" double click on it should be automatic and started. If not change it to be so.

7) reboot - repeat steps 1, 2, and 3.

8) Again, find the service 'Automatic Updates' - double click change it to Automatic and then start the service. ( you are done)

That's the fix - the automatic update services says it is started but it is not.

Follow up steps I took:
I then double clicked on the windows update icon (yellow shield) I choose a custom install - I installed the update - cpu did hit 100% for about 1 to 2 minutes - You need to be patient. when the update installer minimizes I actually click on it to maximize it again just so I can monitor the status. I was about to give up when it started the actual 'installing update' rather than saying initializing which is where it hung in the past. again be patient - 2 minute wait time is long but it will work. The update did install successfully in about 5 minutes. I was fine.

I went to microsoft.com and the updates and ran an update check and all is good - 1 optional update but it ran error free. cpu utilization is at 4%.

A tool you need: Very cool tool. Free tool. Windows XP services.
Called process explorer for windows.

URL: www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

You can see every process - every application running the process - color code them tons and tons of details and options. really cool - small - quck and easy. 10 out of 10. I will try to attach it here as well

Hope this saves someone a lot of pain and frustration.

Enjoy your day - Please don't ask for personal or additional support from me - I did that when Dos 2.1 was an upgrade ... too old and tooo tired : )

Ralph I

[Keith Ritchey]

You are welcome. Nice post.

By the way, I posted here
the probable solution to the 100% CPU load by Automatic Update service.

[stupidenator]

Thank you! I am having this same problem right now with my laptop!

[Cobra-7]

Thanks for this, I am new in here and after much searching the topic, I came to very similar conclusion. Seems to be something in the latest udates that are doing this as both my desktops and laptop all got these issues in the last two days.

[Cobra-7]

Follow up after trying fix: svchost still hogs CPU. The download appears top be trapped in a loop, say downloads are ready, then it is ready to install, then says unsucessful in installation. Download is outlook 2003 malicious ???. only I dont have outlook installed. Tried to access the MS update site and system just put the brakes on for over 30 minutes. Any clues?? Now I know why they invented Linux!

[gerbil]

If you do not use M$ apps like office etc then restrict your updating to Windows updates only - this results in you getting security updates only.
If you are interested in this then go programs > microsoft update, when the web page loads hit options and make your selection there.
Anyway, the idea of the checkboxes in updates is for you to make selections. Be wise tho.

[stupidenator]

What was posted here didn't seem to work on my computer.

I just ended up going to www.windowsupdate.com. On the left side of the screen, there is a "change settings" link. I went there and at the bottom of that page, I disabled microsoft update. This way, you can return to windowsupdate.com and download the updates from there without the cpu reaching 100%. After I got all of the updates, I went back and reinstalled microsoft update and svchost.exe jumped to 100% again.

Unfortunately, now my computer doesn't update on it's own.

[ralphie_boy]

Did you try the info in the original post? I had all the same issues - it took me 12 hours to get the resolution. The way it was fixed was what I put in my original post. You need to stop the services for auto update as per the first post. The utility you download will tell you what service is putting svchost at 100% - just turn that service off by disabling it and reboot. Hope this helps. Ralph

[stupidenator]

I tried your method again and this time it seemed to work this time. Thank you.

By the way... Is it known what is causing this? Is it a virus?

Thanks for all the help!

[Cobra-7]

Further development. Did it all again, now system seems ok until I do a Microsoft update. This is where it all hangs up. As per advice "gerbil", I reset to "Windows "only updates. Now computer is happy. Reference check boxes, very aware of them and the risks associated. thanks.
Jeff

[ralphie_boy]

You're welcome. My CPU hit 100% as well until the update installed which was about 2 to 5 min (may have been longer) then it cleared up - It was hard to be patient but you need to try- if you are launching the updates from the gold shield icon by your clock in the tray - try connecting to the internet before you launch the updates -

I do not know about windowsupate.com - I go direct to microsoft.com then choose security and updates in upper right of the page. I then do a custom install not the express.

It is not a virus or anything - something is interfereing with the updates ability to connect to the website and run the install. (my problem was - I was at a hot spot when I click yes to install the update before I agreed to their terms to internet usage and it crashed the update.)

If you use the gold shield to install double click on it to see details and wait.

IF no luck - I would disable the 3 services in the first thresd - reboot. then re-enable and start them. then go to microsoft.com and try the update. My understanding is that it will only install updates based on what you have installed on your machine - no visio installed - no visio update - no outlook installed - no outlook updates. I could be wrong but I don't think so.

Have a good night and good luck.

Ralph

[gerbil]

What i hoped would be understood is that Microsoft Updates is just gee-gaws for M$ apps. They are not [generally] vital ... they certainly are not fixes for security issues. Those are in Windows Updates. So you don't need MU running constantly.
Further, as far as WU goes, in your security centre make the setting to Notify you when they are available. Don't panic about this, M$ will notify you every time you turn your sys onto the net until you dl or cancel them.

[Cobra-7]

Thanks for that gerbil, I wondered what the MU did that was different. Anyhow all is happy here with Ralphie's fix and your advice. All three computers are back on task here now. Thanks to both of you for your help and advice.
Jeff

[Keith Ritchey]

If I understood you correctly, Ralph, the key moment here is to kill the host process that hosts the WU service, right? Because disabling the service just sets the Start parameter in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv key to 4h.

As the man who worked as the support in 1984, would you please explain the underlying idea of the trick?

[ralphie_boy]

You are all welcome. I am very happy to hear that I made someone's life easier.

As far as the details behind the scenes and the registry settings etc. .... I am no longer the 'hands on' techie I used to be.... and things certainly have changed... : ) Management - sales - marriage - and kids kind of took over. : )

Please understand this is purely my own theory based on my knowledge and experience and I could be wrong. No consipracy theory of anti MS jargon. I stumbled on to the fix through observation and the application of common sense and pure tenacity. When I was done - I informed the Dell support team that told me to reformat and re-install - they confirmed this works and put it in their knowledge base.

In laymans terms: Like most of life's headaches it boils down to a communication problem. The windows update fails for some reason - (in my case, a firewall security issue), and because the update failed, the service halts - which, mind you - is exactly what it should do. When the service halts it is supposed to communicate this to the system by changing its 'status' to stopped. (I think the service Background Intelligent Transfer Service is supposed to do this) this way the system itself would see that the 'Automatic update service' is stopped and either error out right away or since it is set to "automatic start" the system may try to restart the service.

My own thoughts and take on this with my own limited understanding is that the Automatic Update service either, on its own, or via the Background Intelligent Transfer Service, fails to communicate the fact that it is in a stopped state to the system itself. The system itself, like many of us, is clueless, and sees the service as being in a 'started' state and therefore keeps trying to use it with no chance of success. Kind of like starting a car with a dead battery - or continuing a cell phone call after you have been dropped and you don't know it - the message isn't getting through and nothing will change or happen without some manual interference. Hence - We need to re-establish the communication by reseting the status states for the automatic update service and the supporting systems to the proper status settings and, like majic, all is good.

Again, I am glad this is helpful - I have never really involved myself on a board like this before. Thanks to all and please enjoy your day!

Ralph

[Cobra-7]

Sorry been so long in final status of my issues. All of Ralphie's procedure have worked fine now on 5 computers, 2 of my own, my mothers laptop and two mates who were also experiencing the same problem. In my own case, the issue was with MS update and not windows, but the faults were the same, a download that had stopped or failed and then system was in conflict over stop / start etc. By restoring the system to windows only updates, they work great after running the original post fix. As for MS updates, well as gerbil said, they are only geegaws :) I will update office manually when and if I want to from now on. Some happy faces here in down under land thnaks to your help.
Cheers and thanks, Jeff

[Keith Ritchey]

Thanks for your explanations, Ralph. But I still can't get what do you mean under "it says STOPPED on the top even though the other screen says started".
I see Started in the Service status on the General tab of the Automatic Updates Properties dialog window. I see Started in the Status culumn in the Services snap-in. I see STATE: RUNNING querying the service with sc command.
Where do you see it saying that? On with part of dialog window? On the window title? Can you please post the screen showing when you saw this?
It's interesting thing...
Good to see it works for someone at least. Because what I see you do here is you
1. Kill the host process that hosts the WU service
2. Stop the service manually
3. Disable it to protect it from being stopped by OS itself or by someone else
4. Reboot the system
5. Start the service manually and set the start mode back to Automatic
That got your system fixed, correct?

[ralphie_boy]

On the main services screen that lists all your services - the status column as it were, shows Automatic Updates as having the status of "Started" - When you double click on the Service Automatic Updates to see all the details - my screen showed stopped. I cannot remember if it showed stopped in the "service Status line" or as a seperate message at the top of the Service Details window - I really do not recall. Anyhow it was this mismatch that caught my attention and how I finally fixed my problem. Yours may not display the mismatch - I do not know.

And yes - the short / fast fix would be to disable and stop the service - reboot the PC - and then restart the service and the supporting services - it may be easier to disable and stop all 3 then reboot and then set them back to what they are supposed to be. - re run the update in custom mode not express so you can see what is happening and be patient - it will finish.

If you disable the 3 services and then reboot - then go to microsoft.com and security and updates and have it look for updates - it will error out and then give you a message with basically the same steps.

Have a great day.
Ralph

[ges]

Hi Folks,

There's an MS patch for this, that has worked for me. See KB927891. Just recently released too.
I have had this problem with Dell laptops that I support. My workaround was to set the Auto Update service to manual start, and then run it when need. An older MS patch, KB916089, did not work.

[Keith Ritchey]

Thanks Ralph. Glad to see it helped you.

ges,Yeah that's the patch I was talking about in this my post And it helped. That's why I was asking here if this trick with disabling the service and then starting it manually helps because if it's possible to solve problems without patching it sometimes preferrable to do that.

[metti]

:mrgreen: OK - my first post - took 12 hours but tenacity and refusal to"reformat an re-install" (per dell support) wins. I hope this saves someone a lot of pain and frustration. I figured there are a million posts on the problem - why not start a new post with just a solution that worked for me. so you won't have to read for an hour. also a link to a cool utility to monitor the processes on your machine is at the bottom.

Situation: CPU utilization would hit 100% with svchost.exe. Could not figure it out but saw that little shield letting me know Windows automatic update had updates for me to install. When you tried to install them it never happened because of the cpu utilization. If you went to microsoft.com to check for update it would not work/ microsoft updates hang on checking your computer for updates or error out.

Solution: in a nut shell: In Services - the service 'Automatic Updates' - says it is started but in reality it is not.

Resolution:
I am going to give you the fix now rather then at the end of a 200 line write up.

1) Reboot as normal - the moment you see your desktop hit cntrl - shift - esc all at once to bring up the windows task manager. You want it to load before cpu utilization hits 100%

2) When task manager opens click on the services tab to show the services and then click on the cpu column heading to sort the processes by cpu utilization - sort it so the process using the most cpu is on top and you can see it. svchost.exe will show itself there soon enough. (when it does just kill it - I know I will get grief for saying that but you have to because you cannot do anything else.... remember my system did a windows update or was at least trying to)

3) If you have the time and you are not yet hitting that 100% mark with svchost.exe, click Start - run -and type in "services.msc". when the services window loads sort the services by name a-z by clicking on that column heading.

4) find the service 'Automatic Updates' - my guess is it says STARTED and AUTOMATIC on this screen however - double click on it for more details - I will venture to guess in here it says STOPPED on the top even though the other screen says started. It may have even said started at the bottom third of the details screen as well - any how - it is a mismatch. Change this service to "Disabled" and hit apply - you may have to hit STOP (I do not remember but I think you do) when it says disabled and stopped click OK to close I also cannot remember if I rebooted here or not. I think I did but I don't think I needed to. If you do, you will have to go through the steps all over again, so I would try it first without rebooting.

5) On your list of services, find the service called "Background Intelligent Transfer Service" double click to verify but it should be set to Manual and stopped - if so click OK. If not change it to be so.

6) On your list of services, find the service called "Event Log" double click on it should be automatic and started. If not change it to be so.

7) reboot - repeat steps 1, 2, and 3.

8) Again, find the service 'Automatic Updates' - double click change it to Automatic and then start the service. ( you are done)

That's the fix - the automatic update services says it is started but it is not.

Follow up steps I took:
I then double clicked on the windows update icon (yellow shield) I choose a custom install - I installed the update - cpu did hit 100% for about 1 to 2 minutes - You need to be patient. when the update installer minimizes I actually click on it to maximize it again just so I can monitor the status. I was about to give up when it started the actual 'installing update' rather than saying initializing which is where it hung in the past. again be patient - 2 minute wait time is long but it will work. The update did install successfully in about 5 minutes. I was fine.

I went to microsoft.com and the updates and ran an update check and all is good - 1 optional update but it ran error free. cpu utilization is at 4%.

A tool you need: Very cool tool. Free tool. Windows XP services.
Called process explorer for windows.

URL: www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

You can see every process - every application running the process - color code them tons and tons of details and options. really cool - small - quck and easy. 10 out of 10. I will try to attach it here as well

Hope this saves someone a lot of pain and frustration.

Enjoy your day - Please don't ask for personal or additional support from me - I did that when Dos 2.1 was an upgrade ... too old and tooo tired : )

Ralph I

Hi
I have the same problem, ifollowed your instruction but it didnt help. Windows update keep hanging and svchost.exe use 100% when windows start. the only thing that help is to deativate update but i will then get message from windows security center that windows update is turned off. if i can just turn this message off i will be very happy. btw i dont have service called "backgroung intelligence service" or maybe it is not listed in services. any wuold be apperciated.

[gerbil]

Then check page 1 of this thread for my advice.... there is a difference between Windows Update and Microsoft Update [are you sure it was Windows update that caused the hang?]. The state of the former is checked by your security centre, it does not check the latter. If you have them both turned on the updates come down the one pipe.

[DimaYasny]

heyya! I've copied your solution to israel-forum.org and kadets.info forums, with a link to the original of course.

hope you don't mind, and thanks for a helpful article :)

[robtherealtor]

DUDE! This so fixed my computer...Thank you...It only took me 10 hours of working to find this post, after that, 45 minutes to get the fix right. THANKS!
Rob

[ralphie_boy]

Glad to help.
Ralph
www.solutions4jde.com

[stupidenator]

Did this same issue happen AGAIN this last Tuesday to anyone? Because it happened again to me.

[gonzed]

I have tried but it doesn't help (in my case).
Finally, I've find the following link from Microsoft:

http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

The update of the WSUS agent to a 3.0 version seems to help a lot.
In my case on my profesional and on my personal it has solve the problem.

svchost still peak to 100% CPU but
- for short period (30 to 90s)
- the PC is not blocked.
- the update process takes minutes in place of hours:)

Note that there is also an hotfix KB927891 but it seems to cover only specific case (memory leak) and have had no impact when I have installed it...

[Breakinside]

1. Login to Windows in Safe Mode
2. Install and save the following three files from Micio site
Fix_svchost.exe WindowsUpdateAgent30-x86 WindowsXp-KB927891.

Run Fix_svchost.exe first
and the others second.

I am sure this will fix the problem,,,,,IF YOU DONT HAVE VIRUS, but if the problem does not fix then you have Vruse

Hadi Kadhim