SVCHOST 100% CPU

[John Lenz]

I am getting routine 100% CPU pegging on my WinXP client. I have looked into
forums and they suggest auto update. I just upgraded to WSUS 3 SP1 and am
still getting svchost CPU pegging. I installed process Explorer to verify
that is was the checking for auto updates that was causing the issues.

I run Win2K3 SBS R2 with WSUS 3 SP1.

Is there anything I can do to stop this CPU pegging by SVCHOST?

Thx

John

[Lanwench [MVP - Exchange]]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.

1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.

2. Download & install the KB927891 fix (reinstall it if you had previously
done so)

3. Re-set Windows Update & delete the cache, in a command line....

net stop wuauserv

del /f /s /q %windir%\SoftwareDistribution\*.*

net start wuauserv

wuauclt.exe /detectnow

4. Then reboot and run WU/Microsoft Update and make sure everything is fully
patched.

You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[John Lenz]

Hi & Thanks,

I tried the changes you suggested. They have not worked. I am looking at a
pegged CPU for over an hour. Process explorer shows the guilty SVCHOST as
running wcauclt.exe.

Here is what happened during the "fix" process.

When I installed agent3 (WindowsUPdateAgent30-x86) my systems responded that
it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.

I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away), but
soon thereafter, the SVCHOST pegging restarted.

It is only on this one PC. Did I do anything wrong in your process steps?

Thanks, this is driving me crazy. This system is my prime client that I use.

John

"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything is
fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[Les Connor [SBS MVP]]

In task manager, find the PID of the svchost process - you may have to use
View | Select Columns to show PID.

From a command prompt, run "tasklist /svc"

Find the PID for the particular svchost process that's using high CPU, and
post back with the list of processes running in that instance of svchost.
--
Les Connor [SBS MVP]
________________________
Get the SBS BPA here:
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am looking at a
pegged CPU for over an hour. Process explorer shows the guilty SVCHOST as
running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems responded
that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away), but
soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything is
fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[John Lenz]

Les,

Next time I will capture what you are looking for.

I have Process Explorer (SysInternals) running
In the interim, when it pegged, I killed the capture agent, but the CPU load
continued and the process was queuing.dll!Dllinstall+0x1cf37

Does this help narrow the problem

Thx for all your help.

John

Post by Les Connor [SBS MVP]
In task manager, find the PID of the svchost process - you may have to use
View | Select Columns to show PID.
From a command prompt, run "tasklist /svc"
Find the PID for the particular svchost process that's using high CPU, and
post back with the list of processes running in that instance of svchost.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am looking at
a pegged CPU for over an hour. Process explorer shows the guilty SVCHOST
as running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems responded
that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away), but
soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything is
fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[Les Connor [SBS MVP]]

It doesn't help me any, but perhaps someone else recognizes something.
--
Les Connor [SBS MVP]
________________________
Get the SBS BPA here:
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les,
Next time I will capture what you are looking for.
I have Process Explorer (SysInternals) running
In the interim, when it pegged, I killed the capture agent, but the CPU
load continued and the process was queuing.dll!Dllinstall+0x1cf37
Does this help narrow the problem
Thx for all your help.
John

Post by Les Connor [SBS MVP]
In task manager, find the PID of the svchost process - you may have to
use View | Select Columns to show PID.
From a command prompt, run "tasklist /svc"
Find the PID for the particular svchost process that's using high CPU,
and post back with the list of processes running in that instance of
svchost.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am looking at
a pegged CPU for over an hour. Process explorer shows the guilty SVCHOST
as running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems responded
that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away), but
soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything is
fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[John Lenz]

Les - spell check accidentally changed Dll name

it is -> wuaueng.dll!Dllinstall+0x1cf37

Sorry for the confusion. I hope this helps

John

Post by Les Connor [SBS MVP]
It doesn't help me any, but perhaps someone else recognizes something.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les,
Next time I will capture what you are looking for.
I have Process Explorer (SysInternals) running
In the interim, when it pegged, I killed the capture agent, but the CPU
load continued and the process was queuing.dll!Dllinstall+0x1cf37
Does this help narrow the problem
Thx for all your help.
John

Post by Les Connor [SBS MVP]
In task manager, find the PID of the svchost process - you may have to
use View | Select Columns to show PID.
From a command prompt, run "tasklist /svc"
Find the PID for the particular svchost process that's using high CPU,
and post back with the list of processes running in that instance of
svchost.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am looking
at a pegged CPU for over an hour. Process explorer shows the guilty
SVCHOST as running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems responded
that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away),
but soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything is
fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[Les Connor [SBS MVP]]

That's a dll related to windows update, that's about all I know. Whether, or
how, it's related to your issue isn't known, though.

The output from tasklist would be more helpful, to me at least.
--
Les Connor [SBS MVP]
________________________
Get the SBS BPA here:
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les - spell check accidentally changed Dll name
it is -> wuaueng.dll!Dllinstall+0x1cf37
Sorry for the confusion. I hope this helps
John

Post by Les Connor [SBS MVP]
It doesn't help me any, but perhaps someone else recognizes something.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les,
Next time I will capture what you are looking for.
I have Process Explorer (SysInternals) running
In the interim, when it pegged, I killed the capture agent, but the CPU
load continued and the process was queuing.dll!Dllinstall+0x1cf37
Does this help narrow the problem
Thx for all your help.
John

Post by Les Connor [SBS MVP]
In task manager, find the PID of the svchost process - you may have to
use View | Select Columns to show PID.
From a command prompt, run "tasklist /svc"
Find the PID for the particular svchost process that's using high CPU,
and post back with the list of processes running in that instance of
svchost.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am looking
at a pegged CPU for over an hour. Process explorer shows the guilty
SVCHOST as running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems
responded that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away),
but soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything
is fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[John Lenz]

Len

Here is the readout you requested

PID 1848

wuauserv
EventSystem
Browser
CryptSvc
DHCP
TrkWks
ERSVC
helpsvc
dmserver
Netman
Nla
RasMan
Seclogon
WSCSVC
lanmanserver
ShellHWDetection
SENS
Srservice
Schedule
TapiSrv
Themes
AudioSrv
SharedAccess
winmgmt
W32Time
WZCSVC
lanmanworkstation

A long list. When I kill wuauserv, wuaueng.dll kicks in. When I kill that,
theystem stabaizes.

Thx

Post by Les Connor [SBS MVP]
That's a dll related to windows update, that's about all I know. Whether,
or how, it's related to your issue isn't known, though.
The output from tasklist would be more helpful, to me at least.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les - spell check accidentally changed Dll name
it is -> wuaueng.dll!Dllinstall+0x1cf37
Sorry for the confusion. I hope this helps
John

Post by Les Connor [SBS MVP]
It doesn't help me any, but perhaps someone else recognizes something.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les,
Next time I will capture what you are looking for.
I have Process Explorer (SysInternals) running
In the interim, when it pegged, I killed the capture agent, but the CPU
load continued and the process was queuing.dll!Dllinstall+0x1cf37
Does this help narrow the problem
Thx for all your help.
John

Post by Les Connor [SBS MVP]
In task manager, find the PID of the svchost process - you may have to
use View | Select Columns to show PID.
From a command prompt, run "tasklist /svc"
Find the PID for the particular svchost process that's using high CPU,
and post back with the list of processes running in that instance of
svchost.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am looking
at a pegged CPU for over an hour. Process explorer shows the guilty
SVCHOST as running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems
responded that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away),
but soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything
is fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[Les Connor [SBS MVP]]

based on that, Lanwench should have covered the issue. Go back over that
post and make sure.
--
Les Connor [SBS MVP]
________________________
Get the SBS BPA here:
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Len
Here is the readout you requested
PID 1848
wuauserv
EventSystem
Browser
CryptSvc
DHCP
TrkWks
ERSVC
helpsvc
dmserver
Netman
Nla
RasMan
Seclogon
WSCSVC
lanmanserver
ShellHWDetection
SENS
Srservice
Schedule
TapiSrv
Themes
AudioSrv
SharedAccess
winmgmt
W32Time
WZCSVC
lanmanworkstation
A long list. When I kill wuauserv, wuaueng.dll kicks in. When I kill that,
theystem stabaizes.
Thx

Post by Les Connor [SBS MVP]
That's a dll related to windows update, that's about all I know. Whether,
or how, it's related to your issue isn't known, though.
The output from tasklist would be more helpful, to me at least.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les - spell check accidentally changed Dll name
it is -> wuaueng.dll!Dllinstall+0x1cf37
Sorry for the confusion. I hope this helps
John

Post by Les Connor [SBS MVP]
It doesn't help me any, but perhaps someone else recognizes something.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les,
Next time I will capture what you are looking for.
I have Process Explorer (SysInternals) running
In the interim, when it pegged, I killed the capture agent, but the
CPU load continued and the process was queuing.dll!Dllinstall+0x1cf37
Does this help narrow the problem
Thx for all your help.
John

Post by Les Connor [SBS MVP]
In task manager, find the PID of the svchost process - you may have
to use View | Select Columns to show PID.
From a command prompt, run "tasklist /svc"
Find the PID for the particular svchost process that's using high
CPU, and post back with the list of processes running in that
instance of svchost.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am
looking at a pegged CPU for over an hour. Process explorer shows the
guilty SVCHOST as running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems
responded that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right away),
but soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything
is fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[John Lenz]

Guys,

I reapplied and it still pegs. This occurs on only one of my PCs
(unfortunately - mine). I will reformat C: drive and re-install XP SP2 and
see if that clears it up.

Thx for your help.

John

Post by Les Connor [SBS MVP]
based on that, Lanwench should have covered the issue. Go back over that
post and make sure.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Len
Here is the readout you requested
PID 1848
wuauserv
EventSystem
Browser
CryptSvc
DHCP
TrkWks
ERSVC
helpsvc
dmserver
Netman
Nla
RasMan
Seclogon
WSCSVC
lanmanserver
ShellHWDetection
SENS
Srservice
Schedule
TapiSrv
Themes
AudioSrv
SharedAccess
winmgmt
W32Time
WZCSVC
lanmanworkstation
A long list. When I kill wuauserv, wuaueng.dll kicks in. When I kill
that, theystem stabaizes.
Thx

Post by Les Connor [SBS MVP]
That's a dll related to windows update, that's about all I know.
Whether, or how, it's related to your issue isn't known, though.
The output from tasklist would be more helpful, to me at least.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les - spell check accidentally changed Dll name
it is -> wuaueng.dll!Dllinstall+0x1cf37
Sorry for the confusion. I hope this helps
John

Post by Les Connor [SBS MVP]
It doesn't help me any, but perhaps someone else recognizes something.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Les,
Next time I will capture what you are looking for.
I have Process Explorer (SysInternals) running
In the interim, when it pegged, I killed the capture agent, but the
CPU load continued and the process was queuing.dll!Dllinstall+0x1cf37
Does this help narrow the problem
Thx for all your help.
John

Post by Les Connor [SBS MVP]
In task manager, find the PID of the svchost process - you may have
to use View | Select Columns to show PID.
From a command prompt, run "tasklist /svc"
Find the PID for the particular svchost process that's using high
CPU, and post back with the list of processes running in that
instance of svchost.
--
Les Connor [SBS MVP]
________________________
http://support.microsoft.com/kb/940439/en-us

Post by John Lenz
Hi & Thanks,
I tried the changes you suggested. They have not worked. I am
looking at a pegged CPU for over an hour. Process explorer shows
the guilty SVCHOST as running wcauclt.exe.
Here is what happened during the "fix" process.
When I installed agent3 (WindowsUPdateAgent30-x86) my systems
responded that it was already installed.
I then re-applied KB927891 (WindowsXP-KB927891-v3-x86-ENU).
I then stopped the service and deleted the folder files as described
Next I restarted the service and ran /detectnow.
I let that run for a few minutes then rebooted.
After re-boot, it worked for a while (it usually pegged right
away), but soon thereafter, the SVCHOST pegging restarted.
It is only on this one PC. Did I do anything wrong in your process steps?
Thanks, this is driving me crazy. This system is my prime client that I use.
John
"Lanwench [MVP - Exchange]"

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had
previously done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure
everything is fully patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

[n***@gmail.com]

Post by Lanwench [MVP - Exchange]

Post by John Lenz
I am getting routine 100% CPU pegging on my WinXP client. I have
looked into forums and they suggest auto update. I just upgraded to
WSUS 3 SP1 and am still getting svchost CPU pegging. I installed
process Explorer to verify that is was the checking for auto updates
that was causing the issues.
I run Win2K3 SBS R2 with WSUS 3 SP1.
Is there anything I can do to stop this CPU pegging by SVCHOST?
Thx
John

Automatic Updates may be to blame for this.
1. Download & install the Windows Update Agent 3 from
http://support.microsoft.com/kb/926464.
2. Download & install the KB927891 fix (reinstall it if you had previously
done so)
3. Re-set Windows Update & delete the cache, in a command line....
net stop wuauserv
del /f /s /q %windir%\SoftwareDistribution\*.*
net start wuauserv
wuauclt.exe /detectnow
4. Then reboot and run WU/Microsoft Update and make sure everything is fully
patched.
You may see a couple of residual svchost.exe errors (check the
date/timestamps; they are probably old) but this should do it.

Thank you, LanWench, your advice fixed it for me.

The old wuaueng.dll was dated 4/14/2008. The new wuaueng.dll is dated 6/2/2012, downloaded from the link halfway down the page at the KB926464 page:

"Windows Update Agent stand-alone installer for 32-bit (X86-based) computers"
http://download.windowsupdate.com/v6/windowsupdate/redist/standalone/WindowsUpdateAgent20-x86.exe

Now svchost no longer pegs the CPU at 100%. (Before the fix, the machine was nearly unusable unless I lowered the priority of svchost using ProcessExplorer or TaskManager.)

Background synopsis (how I got into this mess): After cleaning malware from an old XP Pro machine w/ IE8 & SP3 installed, Windows reported that it was counterfeit, legitcheck.hta showed a blank white window, and MGADiag reported "blocked VLK," even though this Dell machine has a Dell OEM XP Pro license sticker. I invalidated HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents\OOBETimer so that \WINDOWS\system32\oobe\msoobe.exe /a would run, but it reported a blank Installation ID, and Microsoft phone activation people refused to help without opening a paid support incident. I did a repair install, using an OEM copy of XP Pro w/ SP3 and IE7 slipstreamed, and the "counterfeit software" warning went away, but svchost was still pegging the CPU at 100%, and now IE7 wouldn't run. IE8 wouldn't install; it was supposedly installing updates all night, and never finished. IE7 had the same problem, but after I put your recommended wuaueng.dll update on, I was able to install IE7, which gave me the ability to do windows updates, and I'm now a much happier man.

If you visit the Raleigh area, look me up (e.g., via my geeksalive.com site), and I'll buy you lunch, LanWench!

[Joe]

On Sun, 12 Jan 2014 03:45:22 -0800 (PST)

Post by n***@gmail.com
Thank you, LanWench, your advice fixed it for me.
If you visit the Raleigh area, look me up (e.g., via my
geeksalive.com site), and I'll buy you lunch, LanWench!

You'll have to try a bit harder to track her down. This group has been
abandoned for a couple of years, with the action now at:

http://social.technet.microsoft.com/Forums/en-US/home?forum=smallbusinessserver

I haven't seen any sign of Lanwench since then, a lot of the regulars
didn't seem to move into the somewhat uncomfortable new surroundings. I
only post occasionally, and it's a matter of luck and reading goat
entrails as to which browser might work for me, with what settings. MS
seems to feel the need to tinker constantly with the site.