Jeff Duntemann's Contrapositive Diary Rotating Header Image

October 10th, 2013:

When XP’s svchost.exe Takes 100% of the CPU

I have computers the way some people have mice (those other mice, with legs) and two days ago, a couple of them went nuts. Carol’s SX280 went to 100% CPU usage and roaring fans, and when I turned it on, a second machine (an older SX270) did the same thing. Rebooting changed nothing, though it took a minute or so after reboot for the problem to reappear, which allowed me to do some hasty troubleshooting.

Meanwhile, my quadcore purred along without incident. All three machines use XP SP3, and all three are set for auotmatic updates. I pulled an older SX270 off the shelf that I knew was still at XP SP2 and hooked it up on the bench. Nothing so far. I booted into Windows 7 on my GX620 (it ordinarily runs Mint) and have not seen anything out of the ordinary.

The module sucking all those cycles is the instance of svchost.exe that runs all of the miscellanous Windows machinery, including updates. Hmmmmm.

This is not a new problem; in fact, this rang some bells so old the cloud of dust took an hour to settle. As long ago as 2004, people have reported svchost.exe suddenly taking the whole CPU. Quite a few reports indicated that the culprit was the Windows Update automatic updates client, wuauclt.exe. I turned off automatic updates on the misbehaving machines, rebooted again, and the problem went away.

That’s only a partial solution, of course. And the problem is evidently still with us. In the comments to that post, a user suggested this command series as a fix:

  1. net stop “Automatic Updates”
  2. del /f /s /q %windir%\SoftwareDistribution\*.*
  3. net start “Automatic Updates”
  4. wuauclt.exe /detectnow

In essence, you disable automatic updates, delete all the files from the subdirectory where wuauclt.exe keeps its logs and other data files (you can’t do this if automatic updates is running), restart automatic updates, and then force an immediate check for updates. This worked, and I dusted my hands together in triumph.

Alas, yesterday noonish, both machines again went nuts. Both are scheduled for replacement, so I just let them run. After about two hours of screaming fans, svchost.exe let go of the CPU, and everything returned to normal. In the meantime, my quadcore and that creaky old SP2 machine have shown no symptoms.

I still don’t know precisely what’s going on, but it’s almost certainly some kind of bug in automatic updates. (I’ve scanned all machines for malware and found nothing.) XP updates end next April 1, and by that time I’ll have replaced the two wonky machines with much newer Win7 boxes. (One is already on order.) In the meantime, I’d be curious to hear if anyone reading this has seen the same issue. I expected to see a flurry of online reports and found nothing, right up to a couple of minutes ago. So maybe Carol and I just got to the top of the XP karma fairy’s little list. Still looking, and certainly open to suggestions.