Microsoft seems to be running into some issue with it's recent patches.
This one impacts Windows XP and Windows Server 2003 systems.
I first saw mention of this particular issue when reading the ISC-SANS handler's diary: Mailbag: MS Patches / Symantec Vuln
When some users fire up Windows Update to scan for updates that utilize the Windows Installer (including Office updates), the CPU utilization rate for svchost.exe can lock on 100% for extended time frames.
(Sounds a bit familiar to me: Thawing an XP System and the conclusion at the end of the Mostly Mozilla Madness... post.)
Microsoft's answer for users who have this problem is to first download and install Microsoft's new WSUS 3.0 client to patch the problem. Then install KB927891 (Win32 version linked).
I'd recommend carefully going over and using the detailed links and instructions over at WSUS Product Team Blog post: Svchost /MSI issue follow up.
Tests done by the WSUS team find that this seems to take care of the issue, although the WSUS team notes this caveat:
It’s important to note that with the MSI fix and the new client installed, the CPU may still go near 100%, but the system should still be responsive and not lock up. If another task requires CPU cycles they will be shared, but if the system is idle, MSI will use the full cycles available. If a task is running at the same time as MSI, the system may be slightly slower, but should still be responsive during this time. Key to remember the MSI fix and the new client address unresponsive or locked systems. CPU spikes during some scans are expected, machine unresponsiveness is not. If your watching the process monitor, you will still see 100% CPU during some scans and this is expected behavior.
The WUUS version 3.0 will be mass-released on May 22, but you can get it early using the links I've referenced. If you aren't having any issues, I wouldn't recommend applying this fixes early. And in some cases, users are reporting that this fix isn't helping at all.
Microsoft Updating can be a bit of a mysterious process.
More reference linkage on the issue:
Fix for Microsoft Automatic Updates not working - Via InfoWorld
Microsoft's fix for Automatic Updates lockup not working - Via ComputerWorld
Fix for 100% CPU usage of svchost.exe has been updated but user need WSUS 3.0 too - Via Donna's SecurityFlash
Microsoft WSUS Team test Hotfix KB927891 and WSUS 3.0- Via Donna's SecurityFlash
Determining the Current Version of WUA - Via MSDN
Update on svchost/msi performance issue and 3.0 Client distribution plan - Via WSUS Product Team Blog
--Claus
7 comments:
Claus,
You're a lifesaver. We've been hitting the CPU 100% issue with our svchost.exe for a while now and it freezes up our computer daily. I'll have to look into these steps when I'm home from work. Thanks!
Mike
Hey Japan Years Gang!
I've been loving your posts as well!
I haven't had time to check out your recent photo galleries but hope to this weekend.
I hope the tips help. Microsoft has just (here Stateside at least) "officially" released the updates I mentioned.
Check out my newest post: Windows Updates Updater Updated first before trying the "manual" update method I posted here.
It's possible if you are going to a different Microsoft non-US server location you won't see them "officially" as fast.
Let me know what happens! I'm curious to hear.
Best of luck!
BTW if you happen to see a copy of this when it finally gets released, let me know your opinion.
U.S. Navy to Create Manga to Explain Itself to Japan
Hey Claus,
We were away on vacation for a few days and came back to find that our auto updates updated our computer for us. Sadly, I'm not sure if we connect to a US or non-US Microsoft server location, but we seem to be up-to-date with whatever is available to us.
I heard about the US Navy Manga creation that is supposed to be released here soon. I've been told though that it'll only be released in kanji... no English version. If I see one, though, I will definitely have to buy it for the novelty aspect.
-Mike
Mike,
Did the updates take care of your CPU issue?
I'm asking as Japan Blogger "Natalie Goes to Japan" has been dealing with what sounds like a similar issue: Invasion of the Internet Snatchers
Sounds like your trip was a blast!
Hi,
the procedure describe above didn't help on my computers.
Deleting the Value "NetworkService = DnsCache" in HKLM\Software\Microsoft\WinNT\CurrentVersion\SvcHost
did the trick for me on a lot of systems.
Cheers!
Charles
Hey guys
Deleting the Value "NetworkService = DnsCache" in HKLM\Software\Microsoft\WinNT\CurrentVersion\SvcHost
worked like a charm. All of of the updates and other junk did nothing. Not sure why this is the fix but it worked!
Deleting the registry key "NetworkService = DnsCache" resolved the issue for us too. Not sure what other problems deleting this key may cause so we are testing before deploying... We tried everything else and this was the only thing that worked for us.
Post a Comment