Jeff Duntemann's Contrapositive Diary Rotating Header Image

When XP’s svchost.exe Takes 100% of the CPU

I have computers the way some people have mice (those other mice, with legs) and two days ago, a couple of them went nuts. Carol’s SX280 went to 100% CPU usage and roaring fans, and when I turned it on, a second machine (an older SX270) did the same thing. Rebooting changed nothing, though it took a minute or so after reboot for the problem to reappear, which allowed me to do some hasty troubleshooting.

Meanwhile, my quadcore purred along without incident. All three machines use XP SP3, and all three are set for auotmatic updates. I pulled an older SX270 off the shelf that I knew was still at XP SP2 and hooked it up on the bench. Nothing so far. I booted into Windows 7 on my GX620 (it ordinarily runs Mint) and have not seen anything out of the ordinary.

The module sucking all those cycles is the instance of svchost.exe that runs all of the miscellanous Windows machinery, including updates. Hmmmmm.

This is not a new problem; in fact, this rang some bells so old the cloud of dust took an hour to settle. As long ago as 2004, people have reported svchost.exe suddenly taking the whole CPU. Quite a few reports indicated that the culprit was the Windows Update automatic updates client, wuauclt.exe. I turned off automatic updates on the misbehaving machines, rebooted again, and the problem went away.

That’s only a partial solution, of course. And the problem is evidently still with us. In the comments to that post, a user suggested this command series as a fix:

  1. net stop “Automatic Updates”
  2. del /f /s /q %windir%\SoftwareDistribution\*.*
  3. net start “Automatic Updates”
  4. wuauclt.exe /detectnow

In essence, you disable automatic updates, delete all the files from the subdirectory where wuauclt.exe keeps its logs and other data files (you can’t do this if automatic updates is running), restart automatic updates, and then force an immediate check for updates. This worked, and I dusted my hands together in triumph.

Alas, yesterday noonish, both machines again went nuts. Both are scheduled for replacement, so I just let them run. After about two hours of screaming fans, svchost.exe let go of the CPU, and everything returned to normal. In the meantime, my quadcore and that creaky old SP2 machine have shown no symptoms.

I still don’t know precisely what’s going on, but it’s almost certainly some kind of bug in automatic updates. (I’ve scanned all machines for malware and found nothing.) XP updates end next April 1, and by that time I’ll have replaced the two wonky machines with much newer Win7 boxes. (One is already on order.) In the meantime, I’d be curious to hear if anyone reading this has seen the same issue. I expected to see a flurry of online reports and found nothing, right up to a couple of minutes ago. So maybe Carol and I just got to the top of the XP karma fairy’s little list. Still looking, and certainly open to suggestions.

69 Comments

  1. William Meyer says:

    Well, if it hurts, don’t do that. I have learned, slowly, and with scars, that it is best not to enable Automatic Updates. Not all updates are your friends. In Windows 7 they upped the ante, and you can find yourself losing control of the machine, simply because Windows decided to reboot. This happens because you awakened the machine, and some threshold value is exceeded that says you have ignored for too long.

    Another case is MSE (Microsoft Security Essentials) which many find to be less than essential. On Windows 7 (and presumably later) MSE is considered so essential that enabling Automatic Updates will infect your machine with it, leaving you to remove it again.

    In at least one instance, I have also found that a selected update re-enabled Automatic Updates.

  2. Jonathan O'Neal says:

    Just an FYI: “Process Explorer”, which is part of the excellent SysInternals Suite (now a Microsoft product, available free from here – highly recommended), shows what each separate instance of svchost.exe is doing. By hovering over one instance on my machine, I see it’s handling the DCOM Launcher and Terminal Services, while the next instance is handling RPC, and so on. Using this, you might be able to narrow down which of the myriad svchost services is actually causing your problem. Having located a suspect, you can double-click and examine the running threads in the offending process to determine the exact culprit.

  3. Alex Dillard says:

    I have noticed this many times over several years on a variety of XP machines, both custom built as well as machines from companies like HP and Dell. Seems to me the issue has always been significantly under reported. All my computers have automatic updating disabled. I like to test out the updates before they get applied everywhere. Sometimes windows updates break important stuff unrelated to the update itself: http://www.maximumpc.com/article/news/patch_tuesday_update_breaks_zonealarm_windows_xp_updated

    CPU saturation related to svchost.exe has always been somewhat transient in my experience, with the problem occurring for a short time and then often not returning for months or longer. As such I have never felt the need to investigate. It is very strange though.

  4. Tom Dison says:

    As mentioned by Jonathan above, svchost.exe is a wrapper for windows services. A particular instance may be Window’s Update, or any of an assortment of other services. If you want the details, then use something like SysInternals (as also mentioned above) to find the actual service. When my computer goes slow (which is currently a i5 with 8GB RAM, Win7 Pro 64-bit), I know it’s time to whack a misbehaving svchost.exe. This has occurred on all sorts of machines for the last 8-10 years.

  5. Jack Smith says:

    I have a Dell laptop and a desktop machine with XP that won’t do well under Windows 7, let alone 8, so sometime between now and next April I have to find replacements.

    What are you buying?

    1. I’ve had very good luck with Dell for many years, at least for desktops. All but my custom-built quadcore here right now are Dell machines. The quad will have no trouble with Win7, and my Dell GX620 runs it without any apparent struggle. The SX270s and 280s, well, probably not.

      I have a used Dell 780 USFF on order and it should arrive in a couple of days, with Win7 preinstalled. It’s a dual-core and should be able to handle it. If it checks out, the 780 will become one of the two upstairs machines and I’ll order another.

      Windows 8 won’t run some of the software I use daily, like Office 2000, so it’s not a likely upgrade.

      I’ve had mixed luck with laptops since my practically perfect 2001 Thinkpad X21 croaked in 2005. The X41 convertible was mostly a disaster. I now have a Dell netbook, which is heavier and thicker than a machine of its marginal power (Atom) warrants. I’ve been looking around for some time and haven’t decided on anything yet.

      I’ll summarize my impressions of whatever new hardware we get here in coming months.

      1. Ted says:

        I entered this below and ran in the command prompt on a Windows XP SP3 PC:

        1. net stop “Automatic Updates”
        2.del /f /s /q %windir%\SoftwareDistribution\*.*
        3.net start “Automatic Updates”
        4.wuauclt.exe /detectnow

        The second line del /f… deleted a lot more than just Windows Updates history logs. I wiped out every file except for the folders themselves in My Documents. Many other files were deleted too such as Temp folders, Temporary Internet Folders, Software Distribution Folders, miscellaneous other systems files, etc. I had to reinstall Flash afterwards and System Restore did not restore these files. Luckily I have good backups of My Documents, Music, Pics, etc. I used UndeletePlus to recover more recent files that weren’t on my external back up yet. I don’t know if I might have mistyped the command or not. I should have researched the actions of this command a bit more thoroughly before I executed it in the first place. What a pain. I probably will reinstall the OS to be safe this weekend. Disabling Windows Updates temporarily probably would have been best to deal with the 100 % svchost.exe issue.

        1. Pete says:

          You definitely must’ve typed the command wrong, Ted. The syntax printed is correct; i just tested it myself (this process, incidentally, did not fix the problem – so i decided to just disable Windows Updates). Sorry about your file loss, good luck.

  6. Chester Raffoon says:

    Jeff – you are starting to sound like an old guy who shouts “get off my lawn” at the hip kiddos. XP? Really? Still buying Dell gear? Really? Office 2000? Really?

    How about this – buy a new iMac or two for a workstations upstairs for you and the Mrs, and if you need Windows for something (and most of us all do) either buy a very nice Asus laptop or run a VM on your iMac with Windows 7 or something equally appropriate. Apple has very capable substitutes for Office available from their App Store for about $20 each, and you can install each app legally on five machines.

    XP? Office 2000? Dell? .

    In case you think I’m some kind of a crank, I’m a ham and I used to advertise in PC Techniques. We’re about the same age …

    1. Yes. XP. Office. Dell. Soon to be Windows 7. But still Office. Still Dell. Respect Apple. Won’t give them money.

      Really. Really. Really. Really. Really. Really?

      Yes. Really.

      I’m a crank too. Heh. By the way, you’re welcome on my lawn.

      1. Jack Smith says:

        I’m in a similar position to Jeff in that I have a lot of necessary software that runs only under Windows. For example, EZGPIB programs that control test equipment over the IEEE-488 bus. Also have netSDR receivers controlled with SDRradio software.

        To switch to the Mac world, I would have to hope that all these programs and about another 100 or so, will run under Bootcamp or the like.

        It’s not exactly clear to me that it’s a good idea to add yet another layer of abstraction software – Bootcamp – to reside between the underlying hardware and the OS and the application software. Or, Wine with the various flavors of ‘NIX.

        So, until I see a compelling reason to switch – which must include software compatibility – I see no real alternative to W7. Perhaps W8 will break enough of my legacy programs that this decision will change. But it’s possible to kick the can down the road another few years with W7.

        1. Mike Bentley says:

          I run Win 8 on my projects machine here at the home office. It’s an Apple Retina MBP 15 laptop with 16GB RAM and a half gig of SSD. I like being able to take the machine in for repairs to the original mfr — and have them actually fix it.

          1. The machines I use are cheap enough so that if I can’t fix ‘em (and I do have some experience there) I scrap ‘em. Even laptops are cheap enough used that my exposure is limited to $150 or so. It’s not everybody’s business model, but it’s worked well for me for a long time.

        2. DougC says:

          BootCamp adds NO LAYER as it is a product that allows you to select what you wish to “BOOT”. When you use BootCamp on a MAC and start Windows it is runnings only windows.

          Imagine a PC running XP. You could have installed Linux using a BootManager and at boot CHOOSE which OS to BOOT. Again no layer.

          Using VMs within a desktop does require a “Layer” but with the right product works very well. I use VMware Fusion Pro and it allows me to run Windows apps from my MAC applications list. If desired I can open a windows desktop but so far all has run well.

          I am a Windows user since Netware lost the network wars in the 90′s. I bought a MAC PRO Laptop 15″ Retina simply because I was sick of my Lenova W520 acting like junk. The letters wore off the keys in 8 months and I never took it out of the house. I also have a W710 which was more stable though I once had one get stuck in a dock. To the point where the Lenovo tech came on site and also could not remove it (we had the key). Finally they told him to do whatever it takes and get it off. He literally, with my assistance and tools, cut the docking station off the machine.

          Can you imagine Apple being such crap? I am going to find out.

          Dell Laptops have improved, Never liked HP Laptops but I assume they are no worse. Acer laptops in my experience with only their lower end G Pentium processor series has been enh. Not bad for a $425 laptop but not good either. Asus I have only owned an EEEE and it was shit quality in my experience and it was my bedroom machine only. IE it never left my bedroom and was rarely used for anything more than displaying my NOC monitors.

          Each of us treat systems differently so it is hard to pinpoint weaknesses.

          Bottom line if your work is not critical and you can afford to screw with machine issues on a monthly basis then continue buying low end consumer based stuff in Best Buy. But if you want reliable hardware you need to research carefully and buy business Laptops from Business oriented resellers or direct vendor stores that they all seem to have today. Apple is just good hardware and will likely last longer and hopefully breakdown less often to make the cost worthwhile.

    2. Ok. Having gotten some sleep at the end of a death-march sort of a day, I realize that I may have been rude, for which I apologize. You did, after all, buys ads in my magazine, which I appreciate.

      You certainly didn’t make a particularly good case for the Mac, but rather the usual fanboi thing, which I find grating.

      Consider my modus operandi. As I grow older, I do what I do ever more in response to “thinking it through.” I’m not one for tech culture (and a culture is what Apple sells on top of its engineering, which I grant is superb) and don’t do tech fetishes. Dell’s engineering is engineering enough for my needs. I get the machines used for under $200, and consider them disposable. When they break beyond repair or for whatever reason become obsolete (the SX270s would only accept 2 GB of RAM) I scrap them or give them away. The SX270s make good bookends, too: http://www.contrapositivediary.com/?p=2382

      Dell machines field strip easily, and spare parts can be found dirt-cheap on eBay. I’ve been a repair tech (and a ham, too) for a very long time. Fixing things is second nature here. I’ve even found some of the spare parts useful in other contexts, as with the nice little speakers found in the SX280 USFF family: http://www.contrapositivediary.com/?p=1758

      Windows isn’t great, but it does what I need and I know it inside and out. I’ve had Windows since Windows 1.0 and have used it as my main OS since NT 3.5. I do a lot of work now on Linux Mint, and if I had to move to another OS, that would be it. Runs on anything, free, is extremely reliable, and doesn’t have grumpy lawyers on the other end. My main bitch with Linux generally is that they’re constantly screwing with the UI. I was happy with KDE 3. I didn’t mind GNOME on Ubuntu until they went nuts down there and created Unity.

      Moving to the Mac here would mean several thousand bucks out of my pocket, another damned learning curve, lots of new software (each with its own damned learning curve) and for what? A UI? A brand? A culture? Abilities that I don’t have now? Hardly. I’m not a gamer and don’t edit video. I use integrated graphics. There’s nothing in that walled garden that I particularly want.

      Again, sorry for being a grump. It’s a long story. I’ll stop being a grump if you’ll stop being a fanboi. Deal?

      1. Chester Raffoon says:

        Fanboi?!? Moi? That’s funny, I was the kind of guy who, when someone with a Mac said “it won’t do XYZ” I would reply “buy yourself a real computer, sonny”. Until 18 months ago I didn’t have a single Apple product in my personal inventory. It is a long story about why I finally made the plunge, but once I did I was immediately impressed with simply how well everything worked. This after using nothing but Microsoft products since 1984 when I bought the original Compaq – remember the sewing machine? The Mac Minis are great for the price, you can’t beat the five machine licensing model of the App Store, and for me at least it has been the solution to increasing personal frustration with the Windows software stack.

        That said, the enterprise data centers I manage for a living are full of Dell blades running Microsoft server operating systems – hundreds of them. I have no problem with either company at the enterprise level, and I still have Windows 7 boxes at home (along with Linux, VMware ESXi, etc). But for my daily personal computing needs, I have drunken the Cupertino Kool Aid with both hands.

        Your mileage may vary of course … :-)

        1. DougC says:

          JEEZ

          Well said.

          I am in the same business, had the same ComPaq Luggable that the keyboard snapped on the front except mine was a copy as we had a Chinese computer maker in our building in Manhattan. Ram was added one prom at a time until you had 1 meg if lucky.

          I own about 6 systems in the house which I work from managing clients networks which generally live in Colo’s like Level3 etc. All are Windows and this is my first MAC. I am not raving about it, yet, but it feels well made which I cannot say of my more recent purchases of made for Windows hardware though I am sure they exist if you spend enough.

          To call you a fan boy seems like your post was not read.

      2. Stuart Perkins says:

        Recently, I began experiencing the same svchost pegging cpu on all of my XP VM’s. I’m glad I found the threads about turning off automatic updates.

        I began using Linux with VMWare 4. Moved to 5 then 6 before settling on Ubuntu as a main os and migrated XP to the VM’s. Switched from VMWare to VirtualBox when VMWare went more industrial…and I love the seamless desktop. I groaned when Unity came along, and have switched to Xubuntu (Xfce on top of Ubuntu..no Gnome, no Unity).

        Personally, I’m not an upgrade hound. I will continue to use XP long after support ceases. I only use it when I “need” Windows, which is normally for client support due to a specific VPN or other reason. I still use Dos 6.20 under Qemu to run a personal bookkeeping system I wrote in the 80′s. This system will also run under Dosemu. I even ran it on my Android phone before under a Bochs emulator just to see if I could.

        I’ve been in and out of the *nix world since Sun OS 4.2, Xenix and Unix on the Tandy Model II, so I’ve watched it mature into a mainstream capable system. I doubt it will ever take over from the Mac afficianados or the MicroSoft devoutees as there are still times when a willingness to dive into the command line may be necessary, but free is more attractive than ever these days.

        Anyway, thanks for having this available. Users supporting other users is the Linux way, but has its place in Windows.

    3. SP says:

      No, how about this?

      YOU escrow this guy the couple thou clams that he is going to need for those ‘few imacs’ first.

      Then start whaling on him for getting exceptional value out of a piece of hardware that he’s clearly capable of maintaining long past most technophobes WOULD have just panicked and remortgaged their homes in the nearest ‘Genius’ Bar.

      And yeah, all well and good that apple has ‘very capable substitutes’ as you put it for Microsoft’s sterling workhorse. But then stevie jobs, please his dead heart, was never into software, was he? he made it clear that he made his loot offa people forking out a very, VERY pretty penny for his overpriced shiny baubles.

  7. Stefan says:

    Hi,
    seems like I have the samme issue since October, 11th on a Fujitsu Siemens AmiloPro V8010D running with Windows XP SP3 in germany. I tried to find any viruses since two days, but without success. Even when trying to search from a linux-live-dvd to prevent Windows from starting so the virus may have a chance to hide.
    Thank you for the hints how to get rid of this bug. I’ll try if it works for me too. I didn’t have the courage to run my system for 2 hours on 100% so far :-)

    1. Much depends on the robustness of your machine, but I let a couple of Dell USFFs here run at 100% as long as they needed to, in order to determine if the problem were an endless loop, or just some task so poorly designed and coded so that it takes all the machine’s cycles half-past forever to complete.

      As it happens, both machines survived the exercise, and once I let them finish whatever they were doing in there, the problem has not returned. The slower machine took about three hours to finish up, the faster machine about two hours. They’d both already done some crunching before I stopped them, so I’m guessing the total times would be higher if it all happened in one go.

      I’m still puzzled why my quadcore and a second SX270 have not yet shown the problem.

      1. Stefan says:

        Fortunately my notebook only needed about 20 minutes to get 12 updates. But after downloading the files it went back to 100%-mode.
        I canceled for today and will try again tomorrow. Maybe the 12 files weren’t all that were needed…

  8. Jim Tubman says:

    I would have contributed to this discussion sooner, but we had a death in my wife’s family a week ago and it absorbed my attention. :-(

    For what it’s worth: my main machine (upon which I am typing this) is a 4 year old MacBook Pro. Upon it, I can run MacOS X (and BSD Unix within that), and Windows 7 (under VMWare), and Linux (ditto). I have no use for fanbois (or, as one of my well-respected former bosses called them, “technical bigots”), but for a user who has to choose one machine, a Mac really does provide the most flexibility. Indeed, if you want to write iPhone/iPad apps, a Mac is indispensable. (And the Xcode C++ compiler is FAR more up to date than the Visual Studio equivalent.)

  9. Misha says:

    I’m experiencing this problem too. Over the last year I have noticed a gradual slow-down of Windows Update Scan on freshly installed Windows XP SP3 virtual machines.

    By gradual I mean this: every time Microsoft has rolled out new updates and added them to their inventory, I clearly noticed Windows Update Scan taking longer (on a fresh install of Windows XP SP3) than previously. It used to take 30 seconds. A month later it was 2-3 minutes. A month later again it was 10 minutes. Then 30 minutes. Tonight I waited over an hour. During the scan, 100% of one CPU core is utilized.

    This smells to me like the result of poor coding in the scanning algorithm. Perhaps as the number of available updates (that are not already installed) increases, so too does the scan time, seemingly exponentially.

    Anyway, after installing the first bunch of critical updates (over 120 of them), Windows Update Scan takes a fraction of the time to detect remaining updates.

    My host machine is an i7 3.4GHz so the virtual machines run very fast. Out of interest I wanted to see how long an initial Windows Update Scan would take on an older laptop (can’t remember the specs but it’s many years old). It took over 4 hours! Because the laptop has a single-core CPU, you could clearly see 100% CPU usage. On the 4-core i7 with HT enabled, you see around 12.5% CPU usage (1/8 of 100%) while the scan is in progress.

    I doubt Microsoft has introduced this issue intentionally to help kill of Windows XP, but it wouldn’t surprise me if they intentionally don’t fix it to help kill of Windows XP.

  10. Garan says:

    After a recent batch of updates I started having this problem on an XP sp3 system that had previously been pretty much rock solid. Update svchost began causing cpu to run at 100%, which basically crippled the system until the service was stopped – but that meant Update no longer worked.

    After much Googling I found someone’s blog pointing to this MS Security Bulletin:
    http://technet.microsoft.com/en-us/security/bulletin/ms13-069.

    Tried the relevant update download and then upgraded ie7 to ie8 and it worked like magic. Everything now running smoothly and I can get Windows Update page to work properly again.

  11. Misha says:

    I am pleased to offer a definitive update on this issue. @michael.ar, you are almost spot on.

    This issue comes about because Windows Update is heavily reliant on components of Internet Explorer. If these components are not up-to-date, later versions of Windows Update Agent (that’s the engine that scans for and manages updates) may fail or exhibit very poor performance.

    For folks that are doing a fresh install of Windows XP, the problem will always reveal itself when you try to do your first Windows Update. By initiating an update via the Windows Update website or enabling automatic updates, Windows will first upgrade Windows Update Agent. You cannot prevent this from happening. After that, Windows Update will fail or perform poorly thanks to the dated components of Internet Explorer 6.

    For folks that have an existing Windows XP installation, this problem may still pop up if you have not been regularly updating your Internet Explorer installation.

    It is NOT necessary to install a new version of Internet Explorer to resolve this issue. What is actually required is to install the latest cumulative security update for whatever version of Internet Explorer you have installed. This will be IE6, IE7, or IE8 (if you’re doing a fresh install of Windows XP it will naturally be IE6). This will upgrade the various components of your Internet Explorer installation. Thereafter Windows Update will perform as it should.

    The latest updates are dated October 2013 (as of writing this). Download and install the update that corresponds with your currently installed version of Internet Explorer:

    IE6: WindowsXP-KB2879017-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=40612

    IE7: IE7-WindowsXP-KB2879017-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=40519

    IE8: IE8-WindowsXP-KB2879017-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=40390

    For more information (or for details of updates suitable for 64-bit versions of Windows XP) see http://technet.microsoft.com/en-us/security/bulletin/ms13-080.

    :-)

    Michal

    1. Cristina says:

      Thanks so much, Misha! My XP SP3 system is back!

      Like Jeff, I love my old Dell running XP… Still, I can hardly wait to put my hands on a brand new Windows 8.1 machine.

      Thanks again :-)!

    2. Mischa–

      Many thanks for posting this; sorry I didn’t thank you sooner. I’d already seen the problem occur and pass, but if it happens again I’ll know where to start.

      It’ll be interesting to see if Win7 ever exhibits the same behavior.

  12. Dave says:

    Thanks Misha. It worked.

  13. Lee says:

    Misha, just awesome information. Had to a fix an old system. Reinstalled XP with sp2. Couldn’t first start Windows Update. One of the Microsoft FixIT downloads rectified that problem. Renaming the SoftwareDistribution folder had no affect. Scanning for updates did put the files in the SoftwareDistribution folder but the checking for updates green loading bar just went on and on to no avail. I downloaded the IE8 security cumulative updates as I had already installed it off Microsoft website, and hey presto things work now as they should.

    Can’t thank you enough.

  14. Vicent M. Rodrigo says:

    I use Ubuntu and I need windows for some application.
    I have two windows XP virtual machines.
    I have the same problem but the Misha information does not work for my systems.
    This information is based on a new patch for the internet explorer in its different versions.
    I’ve always had my systems updated so I supposed that applying a patch would not be the solution. But i have tried.
    I have applied the patch in two different XP installations, with IE7 and IE8, and the problem remains: It starts with CPU in its usual load, but in a few seconds searching for updates, the svchost reaches 99% use.
    Of course, one or two hours later the system finishes scanning and shows the patches. But you have a unusable system meanwhile.
    I have heard some colleagues complaining about this problem.

    So it is not a singular problem but a massive one. So of course Microsoft knows it and does not do anything to solve it.

  15. DougCuk says:

    The secret is to install the LATEST Cumulative Security Update for your version of Internet Explorer. This is a recurring problem so the current latest versions keep getting updated each month.

    A Google search will find the latest: https://www.google.com/#q=Cumulative+Security+Update+for+Internet+Explorer

    The latest updates are dated November 2013 (as of writing this).
    Download and install the update that corresponds with your currently installed version of Internet Explorer:

    IE6: WindowsXP-KB2888505-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41064

    IE7: IE7-WindowsXP-KB2888505-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41071

    IE8: IE8-WindowsXP-KB2888505-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41074

    1. JW de Heer says:

      Thanks a lot – I have been debugging for ages to solve the update 100% CPU issue.

      Endly only IE 8 Fix KB 2888505 – did the solution.

      Thanks.

  16. […] — and drew more than 100 comments, many of which repeated the same story. Jeff Duntemann talked about the problem in October — and he traces its origins back to 2004. Now the November 2013 Black Tuesday […]

  17. KS says:

    Vicent M. Rodrigo said “I’ve always had my systems updated so I supposed that applying a patch would not be the solution” and you DougCuk say “The secret is to install the LATEST Cumulative Security Update” – what’s the difference?! Once he has his system updated he is supposed to has all the updates, including the latest, including the cumulative ones.

    Me too update my XP with most of the updates MS issues, and I do have the September and October updates for IE8 and all that, but it didn’t prevent me from having the problem both in October and November, before the new available updates were notified of in the tray icon.

    So that’s not a solution for me (and for some other users).

    It definitely sucks when you start your computer and in a few minutes find yourself unable to browse the internet because of the svchost. I had to just let the update process take its time which took about 20 minutes in October and I guess 40 minutes in November. I just launched task manager and waited till the svchost process drops down from the top position.

    I believe the problem did exist before as well, but then it took much less time so the periods of svchost working seemed to freeze the computer for just a few seconds, maybe minutes. But no matter how long it lasts, no process is supposed to take 90+% CPU for whatever it does. Once it does, it’s poorly designed.

  18. KS says:

    Also I wonder how the people who claim that a latest IE update fixed the problem for them know that is the case. After installing updates and until next updates are released they can’t know if it’s Ok or not cause the svchost process doesn’t do much hence the CPU load is small no matter if the had applied a fix or not.

  19. DougCuk says:

    I claim the fix works because I have applied it to 4 computers myself and seen it work – plus have reports from at least 3 more people who have tried it. The computers are stuck in the searching for update phase and have not yet applied the available updates. Applying the fix allows the Windows Update to proceed normally and install the current updates.

    Based on what Microsoft claim is the cause of the problem the fix appears to work as follows. If you already have the LATEST Cumulative Security Update for Internet Explorer then Windows Update doesn’t search for any further IE updates and so avoids the update bug.

    This is a recurring problem so the fix only blocks the problem – it can occur again next month – until MS fix their broken update program.

  20. Alan says:

    Thankyou DougCuk, In the case of my XP MCE 2005 machine the key was apply the most recent security updates. This problem has been frustrating me for a days, I did a complete clean re-install of the OS & need 129 updates. I had found details of the updates on other threads but the links pointed to updates that didn’t work. I finally found this thread & applied the updates from your links which as of this moment are the most current. CPU usage returned to normal & it successfully download & installed the updates in less than an hour.

    For my machine this is the fix so thankyou very much for your post.

  21. DennisK says:

    Instead of scrapping older machines with XP, I’d recommend installing the LXLE Desktop (Linux distribution). It’s billed as a drop-in replacement for Windows XP, is based on Lubuntu/Ubuntu LTS releases, but without Ubuntu’s ever-changing Unity/GUI issues. I think you will be impressed.

    Available at lxle.net or distrowatch.com.

    I’ve only encountered one temporary problem. The LXLE distribution currently ships with Medibuntu, but the Medibuntu website has since been shut down. When Update Manager tries to update Medibuntu, it can no longer find the website, and issues an error message. Instructions for removing Medibuntu from the Update Manager search list are available at:

    http://lxle.net/forum/#/discussion/comment/307

    1. I hadn’t heard of LXLE, but it looks good, and lord knows, I have enough ten-year-old Dell machines here (SX270s, most of them) to try it out. Much appreciate the link. I’ll write it up here once I try it, though that won’t be in the immediate future due to a heavy book project. One thing I didn’t seen in the writeup is whether or not Wine is preinstalled. That matters. Any insight there?

  22. DennisK says:

    There is a list at DistroWatch showing what packages are included by default with LXLE.

    http://distrowatch.com/table.php?distribution=lxle

    Anything not included by default can be added using the included Lubuntu Software Center application or the Synaptic Package Manager app. That would be the way to install “Wine” & the “Chromium” browser and other desired apps.

    DistroWatch also published a First Impression Review of LXLE:

    http://distrowatch.com/weekly.php?issue=20130909#feature

    Some video reviews: http://lxle.net/video-reviews/

  23. KS says:

    Ok, then it’s a different issue. My issue (and the one in the first post on the page) was that the update process takes 90+% CPU, and it takes it 20 or 40 minutes to do its job (it depends on the compuiter so other peopmle may claim different times), during which the computer is hardly usable, but eventually updating completes after which the computer is quite usable again. If updating never completes (your case) then it’s a different issue and it is supposed to have different solutions.

    And even if I have the latest IE updates Windows can search for other kinds of updates, not just IE, which it did last week for November updates, blocking CPU again.

    One partial solution is just to let it take its time but you have to keep your computer on when you’re not at it, for ex. overnight at office. And if you have to work now you can temporarily turn WU off, then turn it back on when you’re done, and leave it running. When you’re back it’s supposed to be over.

  24. Jon P says:

    Thanks to everyone who has posted on this issue. I just ran into this for the first time this week but have had no luck fixing it. I’ve tried everything list here and a few other tips with no success. I’m throwing in the towel and just disabling Automatic Updates…I know…it’s not the smartest thing to do, but at this point I just need to get the computer usable. I will update the computer (fresh XP install) using an offline update method to get it current to now and just go from there.

  25. Tightwad says:

    KS, your ‘fix’ worries me because (1) my processor is an old Celeron, fast but HOT, (2) I live in Florida, where it’s almost always hot, and (3) I’ve once had a Celeron burn itself out on me. No fun!

    DougCuk, huge thanks for your fix. Not only did it solve my issue this month, but also has hopes of working at least through April.

    And finally, thanks to Jeff Duntemann for this interesting and highly useful column.

  26. Hamburg says:

    Thanks to Misha and DougCuk for this posting. I’m glad that I read down through all the platform bias stuff to get to the meat. I’ve tried the solution on a few machines and, so far, it’s working. I’m really not much of a conspiracy theory type but could Microsoft be attacking its own OS to make the April drop of XP more palatable? Maybe LXLE would be worth the time investment.

  27. DougCuk says:

    Microsoft released a new “Cumulative Security Update for Internet Explorer” today (10th December 2013) – MS13-097: KB2898785.

    But have NOT yet fixed the XP update bug. So we are back to the same problem again – a stuck Automatic Updates service running the SVCHOST process at full CPU load (100% or 50% or 25% depending on how many CPU cores you have)

    MS said they intended to fix the problem by pruning the IE updates database so that only the key Cumulative updates were offered when a search was initiated – this didn’t happen in time for the November updated as intended – and obviously has not happened (or worked) in time for the December update either!

    Temporary fix as before – download and install the latest update manually – KB2898785 – Cumulative Security Update for Internet Explorer: December 10, 2013

    For full version listing see: http://technet.microsoft.com/en-us/security/bulletin/ms13-097

    For Windows XP 32bit here are the direct download links:

    IE6: WindowsXP-KB2898785-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41458

    IE7: IE7-WindowsXP-KB2898785-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41442

    IE8: IE8-WindowsXP-KB2898785-x86-ENU.exe
    http://www.microsoft.com/en-us/download/details.aspx?id=41404

  28. Barry Champlain says:

    Thanks for that new info Doug, nothing like the sensation of 100% usage from questionable origin which usually lends itself to malware. After last month I figured it was just my own issue but after two months in a row I had to google. It updated just fine now with your link.

  29. get IE8 and the patch they suggest from microsoft website says:

    older versions of ie and hence of windows update now cause this problem of 100% CPU (extremely aggressive, cripples machine )
    (MS have changed the update server somehow because fresh installs of XP inc SP3 have this problem ) XP is headding for EOL end of life but not end of accidental sabotage as everything is optimized for people who pay MS for win 8.1. IMHO

  30. ashburnham says:

    Yep, can confirm my XP install went loopy again this morning. Found the latest security update (actually dated 6th Dec 2013 – they didn’t release bulletin until 10th Dec!) has solved the SVHOST.exe problem which has made the system usable.

    What I have noticed though is trying to manually check for Windows Updates after applying this fix has left the webpage searching for the last hour. It is not eating up resources so PC is still usable but doesn’t seem to be proceeding with the Update (not even telling me there is none available)?

    1. ashburnham says:

      Ignore previous comment… it seems the automatic service had started getting the updates in the background but the little yellow icon took over an hour to appear. Closed the web browser from my manual update (that was still searching) and applied updates and all seems to be fine again!

  31. […] with SVCHOST redlined at 100%: Fix it with KB 2879017 | Microsoft windows – InfoWorld oder hier When XP?s svchost.exe Takes 100% of the CPU ? Jeff Duntemann's Contrapositive Diary das problem gibt es schon immer nur seit september hat sich das verhalten extrem verschlechtert. […]

  32. XpUsedToBeStable says:

    Thanks!
    Especially Misha & DougCuk.
    This problem has been nagging me for months, getting worse and worse.
    It looks like you’ve handed me the solution, I just have been able to perform the Updates. Finally!

  33. Preston says:

    Thanks so much. Doug’s Dec 10 links to update Internet explorer did the trick for SVCHOST 100% CPU use.

    I run snow leopard, vmware fusion, windows XP. The windows XP was lightning fast in 2008 on fresh install. It is not lightening fast now but from startup I am running programs in less than 60 seconds- excellent!

    I use avast antivirus as the Microsoft program had some issues with vmware. The avast slows everything down a bit but not too much. As Microsoft drops XP support in 4 months I am done optimizing XP.

    Trying to solve this for years!

  34. DougCuk says:

    Doug Neal from the Microsoft Updates team has posted an update here:
    http://marc.info/?l=patchmanagement&m=138696900324972&w=2

    The conclusion of his email is as follows:

    [QUOTE]While the underlying issue is with the WUA client, such a design change and rollout would take a lot longer and doesn’t resolve the problem in the short term for those impacted now.

    Attempted Fixes
    As a result, we took what we believed were the right steps to expire large chunks of superseded (outdated, unnecessary) updates in the IE6 and IE7 supersedence lists. Testing suggested this would be sufficient and we made the change on the backend in a release in October that expired these many unnecessary updates.

    Turns out the Windows Update Agent has smarts built into it that outsmarted us and the problem persisted for the majority of impacted customers. We made a more comprehensive change in November and an even larger set of logic and expiration changes in December. Unfortunately, the problem still wasn’t solved.

    Our customers have done a great job of letting us know the problem still hasn’t been resolved. We appreciate the quick and detailed feedback. And we share your frustration that we haven’t been able to solve this for you more quickly.

    We’re working diligently to release changes to the supersedence logic that will comprehensively solve this problem. It’s a top priority. And the right (and smartest) people are on it. And as this problem has become more prevalent, we’re working to provide a KB article that will publicly describe the issue so customers can discover it via searches and the recommended guidance. Unfortunately, there is no ‘fix’ or quick workaround that can be applied at this time as we concurrently work to provide a backend fix and some guidance on the real, best solution.

    I appreciate your patience. And want to let you know we’re working through the holiday to provide the right fix as soon as possible. As you can imagine, we don’t have an ETA. And we want to make sure the next fix is the last and comprehensively solves this for our customers.

    Doug Neal – Microsoft Update (MU)[/QUOTE]

  35. Michael Germany says:

    Found this thread as svchost was ticking 100% for a while now and the computer has been slow for over an hour. As I read through the text. it has dropped off and my little sign for new updates has appeared under active tasks. – - Yes. The search for updates seems to be a problem even if the updates aren’t downloading automatically. – - Does that help?

  36. Ugis says:

    In essence, you disable automatic updates, delete all the files from the subdirectory where wuauclt.exe

    Where find wuauclt.exe
    please write the full address C:\

    P.S. win xp profesional

  37. Bob says:

    Jeff,

    This is a very nice site. Thank you for providing it.

    Like others, I landed here after searching for a 100% CPU load by automatic updates through svchost.exe. Reading through this thread led me to the Internet Explorer Cumulative Security Updates (currently described and linked here as of this post).

    Updating to the latest Interest Explorer Cumulative Security Update (for IE8, in my case) and rebooting solved the issues on my machine (an XP x86 SP3 virtual machine running under VirtualBox.

    After rebooting (the VM), the automatic updates service ran and almost immediately processed and offered me the updates that were pending for my machine. They installed very quickly. After another reboot, everything is still working fine.

    Thanks to Misha and others who have pointed out and verified this solution which works for, at least, some of us with this problem.

    Regards,

    Bob

  38. PasserBy says:

    Try installing this http://technet.microsoft.com/en-us/security/bulletin/ms13-097 I found this suggestion on another forum where folks confirmed that it works. I have done the same, rebooted, and voila – no more of that god damned svchost.exe’s madness. And automatic updates work again.

    1. Hedge says:

      The solution posted by PasserBy, DougCuk, and several others works (for Windows XP updates).

      Instead of hours of endless whirring, when trying to use Windows Update, I an now able to reach the list of current updates in about 15 seconds.

      It is an Internet Explorer problem (a bad earlier update from Microsoft.) Once I downloaded the most recent IE6 cumulative update, by going directly to the download site and obtaining and installing that single file, the problem was solved.

      ============ copy of solution repeated here ===========

      December 19, 2013 at 12:06 PM

      Try installing this http://technet.microsoft.com/en-us/security/bulletin/ms13-097 I found this suggestion on another forum where folks confirmed that it works. I have done the same, rebooted, and voila – no more of that god damned svchost.exe’s madness. And automatic updates work again.

  39. AK says:

    Like many others, I run a handful of XP Pro machines and am always loading XP Pro for some new piece of (“legacy”) hardware.

    Why? Because it works. Clean, fast, sleek and does everything that I need it to do. I’d likely still run W2K if it was decently supported because I prefer an OS that is less fluff (eye candy?) and is simply a functional platform for the stuff that I actually want the computer for.

    Macs? iDiotPads? Fine, enjoy. Everything has a place for someone and the Mac OS and Apples (and iDiotPhones) do a fine job. ;-)

    Meanwhile, for those who have continued reading and gotten this far (haha), if you experience the 100% CPU svchost.exe issue (on Win XP Pro and ESPECIALLY on fresh installs!), open task manager (three finger salute, Control Alt Delete) and find the offending instance of svchost that is using the 100% of CPU.

    Click (once to select) on that task and select End Process. Once that is done, go and turn OFF automatic updates (disable) and then use IE (probably IE6) to go on-line as fast as you can and get the Opera browser (version 12.15 or 12.16 are the last “good ones”) or any other “generic” browser of choice (Chrome is OK, or Firefox).

    Do it fast, DL and install it ASAP. Once installed and running (I say to do this because at this point IE6 is a pig), then go in search of the FULL off-line INSTALL for IE7. Don’t fall for the teeny (small size in kb) downloader for the install, you want the FULL install file (15 megs or more?). DL that file and install IE7 ASAP. Re-boot.

    Once IE7 is installed, then try setting Windows Updates for “Download Updates, but let me choose when…” and then when you get the message that Updates are Available… ALWAYS choose Advanced and then look carefully at the updates. De-select almost all updates except updates specifically for IE7 or XP updates and install them SEPARATELY.

    This is a bit tedious but only need be done for the first few series of updates until IE7 is good and then you can proceed with the plethora of XP updates. In my experience, do NOT install IE8 (if ever) until much later in this process. I don’t even use IE8 if I can help it. If you see IE8, uncheck it and then when you get the warning, select “Do not show me this update again”.

    So far this has worked with all “new” installs of XP Pro SP3. Eventually XP updates will be turned off anyway (soon) and then someone may slipstream a stable version of the XP install (including IE7?) for those of us die-hards who would rather fight than switch. Windows 8? OMG, puhh-lease.

    What, are we all kids now? Some of us actually have work to do on these wonderful Personal Computer machines. Touch screens, pods and pads as well as phones playing at being Real Computers are so cute, but fail miserably at real productivity (unless you are 12 and writing the latest game or “app” for the iDiotPhone?).

    Love the comment above where someone claims that Macs are “so flexible” and then mentions the ONE use of writing a game or phone app. Yep, now THAT is flexible. ;-) How about the hundred (or thousand?) of OTHER things that these incredible devices can do? There is a reason why the Mac user share world wide is still well below 10% (OK, perhaps slightly higher, but WTH?).

    There is also a good reason why even the Mac OS runs on a platform based on . . . drum roll . . . UNIX, which is an OS that I believe was pioneered back in the ’60′s (speaking of Ham Radio!). In our “use it for 5 minutes and then toss it into a landfill society”, it is nice that some of us respect and USE gear that can still be useful long after ConsumerMediaCorp would like us to “upgrade”.

    Hope this helps someone.
    Signing off now, call me;
    Curmudgeon

  40. BC says:

    Thanks for the excellent article and comments. I applied the IE8 update but it didn’t solve my problem, so I found my only option was to disable Windows Updates. Unfortunately that means I’ll lose any important updates Microsoft puts out prior to EOL in April 2014. Too bad, I wanted to keep one copy of Windows around for compatibility testing (I use Linux). Thanks.

    1. Arsene says:

      Hi,
      I follow this article, and applied 3 IE8 updates IE8-WindowsXP-KB2879017-x86,IE8-WindowsXP-KB2888505-x86 and IE8-WindowsXP-KB2898785-x86. And the problem is solved.

      You can try to apply all the 3 patch: KB2879017,KB2888505 and KB2898785.

  41. Ugis says:

    Now svchost.exe stirring. But when you run the microsoft website updates, I do not install anything thrown at this – Error Code: 0×80246008

  42. Tarun says:

    Hi, I have a solution for this problem… Install this update in your computer in XP SP 3, your issue will be resolved.

    http://www.bleepingcomputer.com/forums/t/514140/svchostexe-using-100-cpu/
    KB article:-
    IE8: IE8-WindowsXP-KB2888505-x86-ENU.exe http://www.microsoft.com/en-us/download/details.aspx?id=41074

  43. Guys, in case you haven’t seen this link yet, MS claims to have fixed the problem:

    http://redmondmag.com/articles/2014/01/16/windows-xp-resource-hog.aspx

    Let’s hope we’ve now seen the last of those screaming fans!

    1. Jim says:

      Thanks for keeping people informed Jeff. The link you posted talks about Microsoft’s troubles producing a solution. But there doesn’t seem to be a link to the patch. I’m not the only one to voice that. Can you post an URL please? I still have this CPU 100% issue and it is causing issues both on and off the computer.

      1. Jim:

        Read through the comments to this entry, particularly those by Misha and DougCuk.The solution isn’t a patch so much as applying a number of updates to IE. The key update seems to be 2888505. Give that a shot and see how it works.

        Once again, thanks to everybody who provided insights on this!

  44. Ironiff says:

    Bravo! Thx! Your trick saved lot of hours of my time :-)

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>