Windows Update / Microsoft Update / svchost / Autoupdate / 100% CPU

[Patrick Hopp]

We run a domain with about 500 PC's. We've been having a lot of
problems with svchost crashes or 100% CPU usage related to automatic
updates lately. We have done a lot of experimenting and poking around
on newsgroups, and seen many many different posted 'workarounds', etc

None of them seem to work 100%. We've boiled down the workarounds to a
script that looks like this:

net stop wuauserv
net stop BITS
move c:\windows\SoftwareDistribution c:\windows\SDOld
REGSVR32 /s WUAPI.DLL
REGSVR32 /s WUAUENG.DLL
REGSVR32 /s WUAUENG1.DLL
REGSVR32 /s ATL.DLL
REGSVR32 /s WUCLTUI.DLL
REGSVR32 /s WUPS.DLL
REGSVR32 /s WUPS2.DLL
REGSVR32 /s WUWEB.DLL
I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart

and then we manually restart.

And this works great... **As Long** as you don't resetup/reconfigure
Microsoft Update. As soon as you reenable it, wham, your right back
where you started with 100% CPU usage.

Microsoft Update finally came back with the results on my machine after
close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.

It's not a virus, malwar, spyware, etc. It is replicateable on
machines, vmware sessions, fresh builds, old machines, etc. We have
applied the KB927891 hotfix(read the script above) with no effect.

We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
default other applications and the effect seems to be widespread.

Windows Update works fine after the above script, but we would like to
be able to use Microsoft Update to keep Office, etc up to date. Does
anyone know if there is a fix for this out yet, in the works, anything?

If not does anybody know how to unregister Microsoft Update from a
command line, is it a DLL that can be unregistered? Going to the update
site to turn it off individually on 500 machines doesn't sound like fun.

Thanks,

Pat

 

[Guest]

Suggestions here:
http://www.windowsitpro.com/Article/ArticleID/21649/21649.html

- John

 

[PA Bear]

Until a new version of MU is released, reset your default to Windows Update
and obtain Office updates via Office Update website.

 

[John [MSFT]]

Install this fix for now:
http://support.microsoft.com/kb/927891/

This fixes the crashes and improves performance for somewhat faster scans,
and improves the 100% CPU issue in some cases. Still working on the full
final solution.

This fix replaces kb/932494 and kb/916089 for a cumulative fix for all three
issues.

 

[MowGreen [MVP]]

This what launches MU from the Start Menu, Patrick :

D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\muweb.dll,LaunchMUSite

Perhaps unregistering muweb.dll and reregistering wuweb.dll would do the
trick, although reregistering may not be need for the wu .dll.
I'm not totally convinced that this is correct though ... YMMV

On the other hand, why isn't WSUS being used to pull the updates down
and then push them out to the workstations ?


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

 

[PA Bear]

You may have missed...
--
~PA Bear

Install this fix for now:
http://support.microsoft.com/kb/927891/

This fixes the crashes and improves performance for somewhat faster scans,
and improves the 100% CPU issue in some cases. Still working on the full
final solution.

This fix replaces kb/932494 and kb/916089 for a cumulative fix for all
three
issues.

 

[John [MSFT]]

Yep, sorry. This fixes all the known crashes and does some perf
improvements.

There is a corresponding fix "coming soon" in another component that will
fix the "hung UI" issue. It's not the 100% CPU that is the underlying
problem, it is that the UI threads get blocked and the system appears to
hang.

 

[Guest]

I've got a WSUS server here and several boxes experience the 99% CPU usage
problem. I had to disable the WSUS box via group policy. Still waiting on a
fix here.

This what launches MU from the Start Menu, Patrick :

D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\muweb.dll,LaunchMUSite

Perhaps unregistering muweb.dll and reregistering wuweb.dll would do the
trick, although reregistering may not be need for the wu .dll.
I'm not totally convinced that this is correct though ... YMMV

On the other hand, why isn't WSUS being used to pull the updates down
and then push them out to the workstations ?


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

We run a domain with about 500 PC's. We've been having a lot of
problems with svchost crashes or 100% CPU usage related to automatic
updates lately. We have done a lot of experimenting and poking around
on newsgroups, and seen many many different posted 'workarounds', etc

None of them seem to work 100%. We've boiled down the workarounds to a
script that looks like this:

net stop wuauserv
net stop BITS
move c:\windows\SoftwareDistribution c:\windows\SDOld
REGSVR32 /s WUAPI.DLL
REGSVR32 /s WUAUENG.DLL
REGSVR32 /s WUAUENG1.DLL
REGSVR32 /s ATL.DLL
REGSVR32 /s WUCLTUI.DLL
REGSVR32 /s WUPS.DLL
REGSVR32 /s WUPS2.DLL
REGSVR32 /s WUWEB.DLL
I:\fixes\svchost\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart

and then we manually restart.

And this works great... **As Long** as you don't resetup/reconfigure
Microsoft Update. As soon as you reenable it, wham, your right back
where you started with 100% CPU usage.

Microsoft Update finally came back with the results on my machine after
close to 20 minutes on a Xeon 3.06 Ghz machine with 4 gigs of ram.

It's not a virus, malwar, spyware, etc. It is replicateable on
machines, vmware sessions, fresh builds, old machines, etc. We have
applied the KB927891 hotfix(read the script above) with no effect.

We run Windows XP SP2, Office 2003(some 2007), SMS Client, and a host of
default other applications and the effect seems to be widespread.

Windows Update works fine after the above script, but we would like to
be able to use Microsoft Update to keep Office, etc up to date. Does
anyone know if there is a fix for this out yet, in the works, anything?

If not does anybody know how to unregister Microsoft Update from a
command line, is it a DLL that can be unregistered? Going to the update
site to turn it off individually on 500 machines doesn't sound like fun.

Thanks,

Pat