svchost.exe accessing c:\windows\installer

[jon.scriven.removethispart]

Hi,

I have a problem with an XP (SP2) machine whereby svchost.exe
intermittently takes up 100% CPU for several minutes at a time which
grinds what is already an old and tired machine to a halt.

I have done a bit of troubleshooting using Filemon from sysinternals
and can see that it is mainly accessing .MSP files but I cannot work
out what is causing this behaviour (extract of the filemon output
mentioned below).

Looks like maybe XP is trying to self-repair something but from the
fact that this keeps appearing, I am guessing that is is not having
much luck.

Has anyone else experienced this? Any ideas of how to troubleshoot it
further?

Any advice will be gratefully received!


Jon

Filemon Extract:-

2235 11:33:52 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\465de.msp
2236 11:33:52 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\465de.msp
2423 11:33:53 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\4660e.msp
2424 11:33:53 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\4660e.msp
2930 11:33:55 svchost.exe:960 QUERY INFORMATION C:\Program
Files\Sophos\Sophos Anti-Virus\
3015 11:33:55 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adabe.msp
3016 11:33:55 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adabe.msp
3093 11:33:59 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adb2a.msp
3094 11:33:59 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adb2a.msp
3095 11:33:59 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adb5d.msp
3096 11:33:59 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adb5d.msp
3097 11:34:01 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adb3f.msp
3098 11:34:01 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adb3f.msp
3099 11:34:01 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\15a75c.msp
3100 11:34:01 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\15a75c.msp
3101 11:34:01 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\4664e.msp
3102 11:34:01 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\4664e.msp
3103 11:34:02 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adafc.msp
3104 11:34:02 svchost.exe:1056 QUERY
INFORMATION C:\WINDOWS\Installer\2adafc.msp

 

[jon.scriven.removethispart]

Hi,

Just as an update, I have discovered an article which I have posted
below which seems to be the same problem. However, as this was dated
3rd August 2006, I am assuming that there will be a permanent fix
available by now. However, I haven't yet managed to find it. Does
anyone know how to resolve this?


Jon
--------------------------------------------------

Windows Update bug brings computers to crawl with scan

By Margie Semilof, News Director
03 Aug 2006 | SearchWinIT.com


RSS FEEDS: News on enterprise Windows platforms and applications



Windows administrators are grappling with a bug that surfaced last week
in the Microsoft Update scan engine that impedes performance of a
client while undergoing a routine scan.
According to IT experts at MyITForum.com, a site devoted to covering
Windows manageability, the problem can cause Microsoft Update and
Windows Software Update Services (WSUS) around five minutes per scan on
a client.

"During the scan the processor utilization spikes and is maintained by
the scan," according to Microsoft's analysis of the problem posted on
the site.

"When a computer is scanned, there is a lot of hard disk utilization
anyway, but it takes a lot of CPU cycles to do the scan," said one
expert. "So both hard drive and CPU are being impacted."

IT administrators in companies that don't have all the latest computers
with plenty of RAM will likely be the hardest hit.

Initially, administrators thought the bug was connected to the
Inventory Tool (ITMU) for Microsoft Updates in Systems Management
Server, Microsoft's desktop management software. ITMU determines the
management compliance of managed systems. Anti-virus scanning was also
suspected.

But Microsoft has determined that it was not just an SMS issues but a
bug in how Microsoft Update scan works, according to Robert Stack, a
London-based SMS administrator in a post to MYITForum.com.

Microsoft has identified reasons for the slowdown. They are:

Older hardware -- a slow disk and CPU will increase scan time and CPU
usage
Growing catalog
Software competing for CPU cycles, such as anti-virus software
Busy computer at logon. Adding a scan on top of other logon items will
impact the CPU and increase the scan time
Microsoft has said it is looking into potential solutions to the
problem. The company is suggesting as one workaround to schedule the
scan and patch installation during non-business hours. This option
won't help laptop users who would be affected as soon as they log in.

 

[jon.scriven.removethispart]

Does anyone have a workaround or fix for this as it is crippling our
network.....


Jon