Windows Update causes svchost.exe 100% CPU

[tjwib]

I have a Windows SBS 2003 Server and when it reaches certain critical updates (ie 835732 & 823182) using Windows Update the svchost.exe shows high utilization and cpu goes to 100%. It happens after the update is downloaded and a couple notches into installation. After about 10 minutes the screen goes blank showing only the background color. I tried letting it go overnight but it never finished. Then I have to reset it. I was able to install some updates one by one and the 2 mentioned above are all thats left and causing the problem. They both do the same thing. The 835732 caused the problem first and took a server that ran perfect and caused all kinds of problems. I tried to get the update manually and when I installed it, it made things worse. It locked up, so I had to reboot and it gave the msg lsass.exe - unable to locate component and was referring to lsasrv.dll. This was fixed by booting under last known good config. This also caused my cipher strength to drop to 0 bit which took quite a while to get back to 128 bit through the 128 bit upgrade ran a few times. When the ie was at 0 bit, I also could not get into windows components of the add/ remove prog area as well as windows update. My server ran perfect until I tried to get all up to date with the sasser worm going around. At this point, the worm might have been easier to fix. Please help me, I have spent hours researching this and the Server is out of commision until I can get this fixed.

Also, just a side note. I had another server that was about 2 days old that caused the exact same scenario when I went through the Windows Update process. I tried repairing the install which brought me from 0 to 128 bit and tried the update again, but kept going in circles. I eventually ended up reloading it and got it to go through if I did all the updates first and one by one (just to be safe). But now I am afraid to update all of my other clients servers out there because of this issue

PLEASE HELP, I only ask for it when I really need it

Thank

T
***@dynamicbilling.co

[mike]

yeah! same here. would have been easy dealing with the worm. upadated winME and have CPU 100%
nothing related to sasser worm on winM

[a***@discussions.microsoft.com]

uninstall the latest critical updates and run a firewall
for protection. and use a better browser with mozilla.org
'firefox'

-----Original Message-----
I have a Windows SBS 2003 Server and when it reaches

certain critical updates (ie 835732 & 823182) using Windows
Update the svchost.exe shows high utilization and cpu goes
to 100%. It happens after the update is downloaded and a
couple notches into installation. After about 10 minutes
the screen goes blank showing only the background color. I
tried letting it go overnight but it never finished. Then
I have to reset it. I was able to install some updates one
by one and the 2 mentioned above are all thats left and
causing the problem. They both do the same thing. The
835732 caused the problem first and took a server that ran
perfect and caused all kinds of problems. I tried to get
the update manually and when I installed it, it made things
worse. It locked up, so I had to reboot and it gave the
msg lsass.exe - unable to locate component and was
referring to lsasrv.dll. This was fixed by booting under
last known good config. This also caused my cipher
strength to drop to 0 bit which took quite a while to get
back to 128 bit through the 128 bit upgrade ran a few
times. When the ie was at 0 bit, I also could not get into
windows components of the add/ remove prog area as well as
windows update. My server ran perfect until I tried to get
all up to date with the sasser worm going around. At this
point, the worm might have been easier to fix. Please help
me, I have spent hours researching this and the Server is
out of commision until I can get this fixed.

Also, just a side note. I had another server that was

about 2 days old that caused the exact same scenario when I
went through the Windows Update process. I tried repairing
the install which brought me from 0 to 128 bit and tried
the update again, but kept going in circles. I eventually
ended up reloading it and got it to go through if I did all
the updates first and one by one (just to be safe). But
now I am afraid to update all of my other clients servers
out there because of this issue.

PLEASE HELP, I only ask for it when I really need it.
Thanks
TJ
.

[tjwib]

I don't know if this will help anyone, but when I install the 835732 update it locks up and removes the c:\windows\system32\schannel.dll file and this causes the ie to go from 128 bit to 0 bit. And when it is at 0 bit, the win updt will not run. I put the file on from another server and I get 128 bit back. But it still does not explain how to install the update and get past the "bug

MS Please stop ignoring us and give us something to work from, we can help each other

[w***@bootit.com]

I have been having the same problem on a windows 2003 enterprise
server. I am sure that the problem is related to windows update in some
way. Its not what the previous poster said about firewall and better
browser.

I have experimented with the SUS server for applying patches but then
reverted what I thought were the registry changes required for SUS. I
have automatic update set to download, install and notify me. I come
in, in the morning and notice server is "frozen". After 15 minutes I
can get to console to see what the problem is.

that's my contribution. I don't the fix or cause.

wr

Post by a***@discussions.microsoft.com
uninstall the latest critical updates and run a firewall
for protection. and use a better browser with mozilla.org
'firefox'

-----Original Message-----
I have a Windows SBS 2003 Server and when it reaches

certain critical updates (ie 835732 & 823182) using Windows
Update the svchost.exe shows high utilization and cpu goes
to 100%. It happens after the update is downloaded and a
couple notches into installation. After about 10 minutes
the screen goes blank showing only the background color. I
tried letting it go overnight but it never finished. Then
I have to reset it. I was able to install some updates one
by one and the 2 mentioned above are all thats left and
causing the problem. They both do the same thing. The
835732 caused the problem first and took a server that ran
perfect and caused all kinds of problems. I tried to get
the update manually and when I installed it, it made things
worse. It locked up, so I had to reboot and it gave the
msg lsass.exe - unable to locate component and was
referring to lsasrv.dll. This was fixed by booting under
last known good config. This also caused my cipher
strength to drop to 0 bit which took quite a while to get
back to 128 bit through the 128 bit upgrade ran a few
times. When the ie was at 0 bit, I also could not get into
windows components of the add/ remove prog area as well as
windows update. My server ran perfect until I tried to get
all up to date with the sasser worm going around. At this
point, the worm might have been easier to fix. Please help
me, I have spent hours researching this and the Server is
out of commision until I can get this fixed.

Also, just a side note. I had another server that was

about 2 days old that caused the exact same scenario when I
went through the Windows Update process. I tried repairing
the install which brought me from 0 to 128 bit and tried
the update again, but kept going in circles. I eventually
ended up reloading it and got it to go through if I did all
the updates first and one by one (just to be safe). But
now I am afraid to update all of my other clients servers
out there because of this issue.

PLEASE HELP, I only ask for it when I really need it.
Thanks
TJ
.

[Robert Aldwinckle]

[cross-posted from WindowsUpdate to SBS]

http://groups-beta.google.com/group/microsoft.public.windowsupdate/browse_frm/thread/278b9e51e385cbf/16adfa511e0582b7?q=SBS+CPU++group:microsoft.public.windowsupdate&_done=%2Fgroups%3Fhl%3Den%26q%3DSBS+CPU++group:microsoft.public.windowsupdate%26qt_s%3DSearch+Groups%26&_doneTitle=Back+to+Search&&d#16adfa511e0582b7

I am sure that the problem is related to windows update in some way.

Try using procexp (Process Explorer) from SysInternals
to see if it gives you any more clues about which service
is doing that. (It seems to give more statistics than Task Manager
but still only for the set of services grouped by that task. If there
is more than one service being run under that task it may not be
the one you think it is.)

You could also list the potential culprits (in a command window) with

tasklist /svc /fi "Imagename eq svchost.exe"

then look at the services listed under the suspect PID.

After 15 minutes I can get to console to see what the problem is.

How? Are you stopping the service?
Is that how you know that it is related to Windows Update?

Have you looked in the logs for more specific clues?


BTW while you are not the first SBS user to report a problem with
CPU usage you do seem to be the first to attribute it to AU: ;)

http://groups-beta.google.com/groups?hl=en&q=CPU+svchost++MVP+%7C+MSFT+group%3Amicrosoft.public.windows.server.sbs

(I'm cross-posting this answer there in case another SBS user
has some better ideas for you.)


HTH

Robert Aldwinckle
---

I have been having the same problem on a windows 2003 enterprise
server. I am sure that the problem is related to windows update in some
way. Its not what the previous poster said about firewall and better
browser.
I have experimented with the SUS server for applying patches but then
reverted what I thought were the registry changes required for SUS. I
have automatic update set to download, install and notify me. I come
in, in the morning and notice server is "frozen". After 15 minutes I
can get to console to see what the problem is.
that's my contribution. I don't the fix or cause.
wr

Post by a***@discussions.microsoft.com
uninstall the latest critical updates and run a firewall
for protection. and use a better browser with mozilla.org
'firefox'

-----Original Message-----
I have a Windows SBS 2003 Server and when it reaches

certain critical updates (ie 835732 & 823182) using Windows
Update the svchost.exe shows high utilization and cpu goes
to 100%. It happens after the update is downloaded and a
couple notches into installation. After about 10 minutes
the screen goes blank showing only the background color. I
tried letting it go overnight but it never finished. Then
I have to reset it. I was able to install some updates one
by one and the 2 mentioned above are all thats left and
causing the problem. They both do the same thing. The
835732 caused the problem first and took a server that ran
perfect and caused all kinds of problems. I tried to get
the update manually and when I installed it, it made things
worse. It locked up, so I had to reboot and it gave the
msg lsass.exe - unable to locate component and was
referring to lsasrv.dll. This was fixed by booting under
last known good config. This also caused my cipher
strength to drop to 0 bit which took quite a while to get
back to 128 bit through the 128 bit upgrade ran a few
times. When the ie was at 0 bit, I also could not get into
windows components of the add/ remove prog area as well as
windows update. My server ran perfect until I tried to get
all up to date with the sasser worm going around. At this
point, the worm might have been easier to fix. Please help
me, I have spent hours researching this and the Server is
out of commision until I can get this fixed.

Also, just a side note. I had another server that was

about 2 days old that caused the exact same scenario when I
went through the Windows Update process. I tried repairing
the install which brought me from 0 to 128 bit and tried
the update again, but kept going in circles. I eventually
ended up reloading it and got it to go through if I did all
the updates first and one by one (just to be safe). But
now I am afraid to update all of my other clients servers
out there because of this issue.

PLEASE HELP, I only ask for it when I really need it.
Thanks
TJ
.