Another 0x745f2780 error upon restart in "svchost.exe"

[KentM]

We use WSUS in our campus environment and since either late June or early to
mid-July we have been experiencing this error randomly across our network
client computers (all are Windows XP SP2, fully patched). To the extent that
Automatic Updates is the "problem", it appears to be true that if we disable
this service the error will not appear upon restart. We are not sure,
though, if the Automatic Updates client is THE problem (it WAS updated when
WSUS 2.0 SP1 was installed on our WSUS servers, though - didn't have this
problem with the previous client from WSUS 2.0 RTM), or if some other update
(recent?) is interfering with the Automatic Updates service.

When this particular instance of "svchost.exe" crashes, it takes out about
16 sub-services, but only restores about five of them. As others have
reported, this leaves the machine in a sort of useless state when trying to
run additional programs, access various resources, etc. Has anyone narrowed
this problem any further??? A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly.

And finally I'd like to add that this seems to be a significant/growing
problem popping up in more and more posts, but so far Microsoft has been
suspiciously silent on the subject.

[Lawrence Garvin (MVP)]

Post by KentM
A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly

A solution is a solution.. and usually the only solution.. if it's
available.

But if you'd care to share the "solution" I'd be happy to comment on its
applicabilty, or even suggest alternatives for a large environment.

Searching this newsgroup (microsoft.public.windows.server.update_services)
via Google Groups for the keyword 'svchost' may also turn up recent
conversations about this or related issues.)

[KentM]

Hi Lawrence,

Thank you for answering my post. The solution "liz" has been refering
others to is
http://www.infohq.com/cgi-bin/ikonboard/topic.cgi?forum=4&topic=181. Opinion?

~Kent

Post by Lawrence Garvin (MVP)

Post by KentM
A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly

A solution is a solution.. and usually the only solution.. if it's
available.
But if you'd care to share the "solution" I'd be happy to comment on its
applicabilty, or even suggest alternatives for a large environment.
Searching this newsgroup (microsoft.public.windows.server.update_services)
via Google Groups for the keyword 'svchost' may also turn up recent
conversations about this or related issues.)
--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
.....

[Lawrence Garvin (MVP)]

Post by KentM
Hi Lawrence,
Thank you for answering my post. The solution "liz" has been refering
others to is
http://www.infohq.com/cgi-bin/ikonboard/topic.cgi?forum=4&topic=181.
Opinion?

The cruz of this 'fix' is:

<quote>
I just resolved my issue by turning off automatic updates, reboot, then
manually going to windows updates and installing the updates, turing on
automatic updates, reboot.

It seems that code has to do with some sort of Pentium program error
detection. I would assume that my machine failed to autoinstall an update
and this error was the result...please try and I hope this helps you out.
</quote>

The bad news is that there is, in fact, no way to implement this on a large
scale, most notably the "Go to Windows Update" part.

However, I suspect this 'workaround' may simply be a functional fix for what
the real problem is. Unfortunately, I don't have any specific information in
my head at the moment, but I do recall some discussions recently about
svchost.exe issues. Let me do some research, and, if necessary, I'll forward
this info on to the WUA dev team and see if they have any additional
information.

I suspect, however, that the real /fix/ probably can be implemented in an
enterprise environment, we just need to identify what is actually being
accomplished by this particular procedure.

Not: Turning off Automatic Updates (I'm not sure if it's mean stopping the
service, or setting the Option to disabled), and rebooting will simply
result in the service being restarted after reboot. So, let's presume it
means disabling the use of Automatic Updates. This part can be done through
group policy -- simply set the Configure Automatic Updates policy to
DISABLED, and wait for the policy refresh.

So... installing updates from Windows Update.. instead of from WSUS. This
makes me believe the core issue may be a defective update package in WSUS,
or perhaps a 'bad' installation of an update package.. both of which would
be 'fixed' by forcing the update from Windows Update.

An equivalent you might try....

(a) Shutdown the AU service (btw, this also can be done through group
policy).
(b) Delete the contents of the %windir%\SoftwareDistribution\Download
folder.
(c) Determine which updates were scheduled for installation (reviewing
the client's ReportingEvents.log is the quickest way to do this),
mark those updates as DECLINED on the WSUS server, and then run the
PurgeUnneededFiles tool, to remove the content from the content store.
(d) Uninstall the updates from the client that show as installed in the
Add/Remove Programs dialog.
(e) Reset the approvals for those updates to APPROVED, and let the WSUS
server download fresh copies. (Make sure you're WSUS server is not getting
content from a proxy cache, which could result in the same 'defective'
content being downloaded again.)
(f) Force a detection at the client using 'wuauclt /detectnow'.
(g) Run the installation interactively, and ensure that all of the
updates have installed. You might even consider installing the updates
one-at-a-time, just to be sure every one has installed.
(h) If (a) through (g) works for one computer, then set up another
computer to install via the /scheduled/ installation, and note the results.
--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
....

Post by KentM
~Kent

Post by Lawrence Garvin (MVP)

Post by KentM
A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly

A solution is a solution.. and usually the only solution.. if it's
available.
But if you'd care to share the "solution" I'd be happy to comment on its
applicabilty, or even suggest alternatives for a large environment.
Searching this newsgroup
(microsoft.public.windows.server.update_services)
via Google Groups for the keyword 'svchost' may also turn up recent
conversations about this or related issues.)
--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
.....

[j***@gmail.com]

Any other solutions for this problem?? We tried your suggestion below
and then we actually completely rebuilt our WSUS. New hardware, new
everything. Did you send the issue on to the WUA dev team? We can not
find any pattern to the problem across our network. It seems
completely random. Sometimes rebooting 4-5 times fixes the issues,
sometimes we restore an earlier system state, sometime we boot with
"Last Known Good", sometimes we just re-image the workstation.
Currently we have WSUS turned off for half of the campus. We need to
get it running again prior to the Fall semester. Help!?

Joe Marshall
Frederick Community College

[KentM]

We've spent the past week further researching the source of this problem and
unfortunately we have been unable to determine anything conclusive. All we
have managed to figure out so far is that disabling "Automatic Updates" (AU)
makes the problem go away...but then so much for "automatic" updates, right?
So...that's not a solution. We have tested many different scenarios such
that at the end of one day we think we have the problem isolated and a
solution looks promising, but then that all changes the next day when the
problem reappears. I completely agree w/Joe's sentiments: This IS completely
random.

Some of the more interesting scenarios we tested:

We setup an "older" WSUS 2.0 RTM server and pointed a workstation at it
built from an older image of ours we created before the June updates/patches.
We did NOT upgrade it to WSUS 2.0 SP1, so our test workstation was forced to
use the older AU client. The result? We are still seeing this problem after
it downloaded the June and July updates/patches. In a further test, we then
unapproved all June and July updates/patches, and again rebuilt the
workstation from the older image. Now the workstation had no patches to
download and install. The result? The problem still appears. I'm not sure
what this exactly means other than AU is not the problem, OR the problem is
common to both versions of AU. Perhaps it means the WSUS server is the
problem. It could even be an older patch we have yet to un-approve is
causing the issue. (???)

I've also reversed a "Windows Update" group policy setting we've used for
the better part of a year such that updates that no longer require a reboot
are immediately installed. Anyway, I reversed it and now, once again, all
updates/patches are installed at the same set time. I/We figured that
perhaps some patch got "mis-defined" by Microsoft (this happened once in the
past much to the "amusement" of our many campus end-users who had their
workstations unexpectedly rebooted) and was attempting to restart the system
or something while other AU activity was in progress that wasn't expecting a
restart. Anyway, this looked promising one day, but the same errors returned
the following day. (???)

Basically we are probably at a point where we are going to have to spend the
$245 to call Microsoft's tech support. Actually we probably passed that
point a couple days back…. Either way, I'm not presently in the mood for an
"India call", but will probably have to do so early next week unless we find
something later today/Friday.

Post by j***@gmail.com
Any other solutions for this problem?? We tried your suggestion below
and then we actually completely rebuilt our WSUS. New hardware, new
everything. Did you send the issue on to the WUA dev team? We can not
find any pattern to the problem across our network. It seems
completely random. Sometimes rebooting 4-5 times fixes the issues,
sometimes we restore an earlier system state, sometime we boot with
"Last Known Good", sometimes we just re-image the workstation.
Currently we have WSUS turned off for half of the campus. We need to
get it running again prior to the Fall semester. Help!?
Joe Marshall
Frederick Community College

[j***@gmail.com]

Anything new? We're reverting to a number of fixes.

Rebooting 3-5 times
Last Known Good Config
Restore Point
Reinstalling Updates
Uninstalling and then reinstalling updates

Nothing helpful and nothing that is not extremely time consuming. Have
you opened your incident with Microsoft yet?

[Lawrence Garvin (MVP)]

Post by j***@gmail.com
Anything new? We're reverting to a number of fixes.
Rebooting 3-5 times
Last Known Good Config
Restore Point
Reinstalling Updates
Uninstalling and then reinstalling updates
Nothing helpful and nothing that is not extremely time consuming. Have
you opened your incident with Microsoft yet?

I'm due back an answer from somebody on the dev team within 48 hours.

[KentM]

Howdy,

Nothing new to report. We've had to let this "project" slide for a few days
while we get other stuff going for the start of the semester early next
month. However, other things we have tried with some success include
clearing a "mofcomp.exe" item out of our startup scripts and, to an even
greater degree of success, breaking the "wuauserv" service (i.e., "AU"
client) out into its own process. Normally it runs under "svchost.exe" with
a TON of other services (15 or 16 at last count - seems excessive). This
move seems to have gotten rid of the majority of our errors on our test
machines, but we have not done anything campus wide yet as I'm of the opinion
we shouldn't have to do anything like that campus wide. Anyway, other stuff
for you to play around with, especially the latter to see if you get a
similar result.

~Kent

Post by j***@gmail.com
Anything new? We're reverting to a number of fixes.
Rebooting 3-5 times
Last Known Good Config
Restore Point
Reinstalling Updates
Uninstalling and then reinstalling updates
Nothing helpful and nothing that is not extremely time consuming. Have
you opened your incident with Microsoft yet?

[Lawrence Garvin (MVP)]

Post by KentM
Basically we are probably at a point where we are going to have to spend the
$245 to call Microsoft's tech support. Actually we probably passed that
point a couple days back.. Either way, I'm not presently in the mood for
an
"India call", but will probably have to do so early next week unless we find
something later today/Friday.

Kent, I'm working with the dev team to try to get some resolution to this
issue...

Can you email me the complete WindowsUpdate.log from this system, along with
the SoftwareDistribution.log from your WSUS server to l r g a r v i n @ e f
o r e s t . n e t

The SoftwareDistribution.log is in %programfiles%\Update Services\Logfiles
--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
....

Post by KentM
We've spent the past week further researching the source of this problem and
unfortunately we have been unable to determine anything conclusive. All we
have managed to figure out so far is that disabling "Automatic Updates" (AU)
makes the problem go away...but then so much for "automatic" updates, right?
So...that's not a solution. We have tested many different scenarios such
that at the end of one day we think we have the problem isolated and a
solution looks promising, but then that all changes the next day when the
problem reappears. I completely agree w/Joe's sentiments: This IS completely
random.
We setup an "older" WSUS 2.0 RTM server and pointed a workstation at it
built from an older image of ours we created before the June
updates/patches.
We did NOT upgrade it to WSUS 2.0 SP1, so our test workstation was forced to
use the older AU client. The result? We are still seeing this problem after
it downloaded the June and July updates/patches. In a further test, we then
unapproved all June and July updates/patches, and again rebuilt the
workstation from the older image. Now the workstation had no patches to
download and install. The result? The problem still appears. I'm not sure
what this exactly means other than AU is not the problem, OR the problem is
common to both versions of AU. Perhaps it means the WSUS server is the
problem. It could even be an older patch we have yet to un-approve is
causing the issue. (???)
I've also reversed a "Windows Update" group policy setting we've used for
the better part of a year such that updates that no longer require a reboot
are immediately installed. Anyway, I reversed it and now, once again, all
updates/patches are installed at the same set time. I/We figured that
perhaps some patch got "mis-defined" by Microsoft (this happened once in the
past much to the "amusement" of our many campus end-users who had their
workstations unexpectedly rebooted) and was attempting to restart the system
or something while other AU activity was in progress that wasn't expecting a
restart. Anyway, this looked promising one day, but the same errors returned
the following day. (???)
Basically we are probably at a point where we are going to have to spend the
$245 to call Microsoft's tech support. Actually we probably passed that
point a couple days back.. Either way, I'm not presently in the mood for
an
"India call", but will probably have to do so early next week unless we find
something later today/Friday.

Post by j***@gmail.com
Any other solutions for this problem?? We tried your suggestion below
and then we actually completely rebuilt our WSUS. New hardware, new
everything. Did you send the issue on to the WUA dev team? We can not
find any pattern to the problem across our network. It seems
completely random. Sometimes rebooting 4-5 times fixes the issues,
sometimes we restore an earlier system state, sometime we boot with
"Last Known Good", sometimes we just re-image the workstation.
Currently we have WSUS turned off for half of the campus. We need to
get it running again prior to the Fall semester. Help!?
Joe Marshall
Frederick Community College

[KentM]

Hi Lawrence,

I just e-mailed you the logs you requested below. The e-mail has a 3 MB
attachment. Just letting you know here in case you check this first. I had
some problems with the e-mail address you gave me below, but...it looks like
the e-mail went through. Let me know if you didn't receive it.

Thanks again for your assistance,
~Kent

Post by Lawrence Garvin (MVP)
Kent, I'm working with the dev team to try to get some resolution to this
issue...
Can you email me the complete WindowsUpdate.log from this system, along with
o r e s t . n e t
The SoftwareDistribution.log is in %programfiles%\Update Services\Logfiles

[Lawrence Garvin (MVP)]

Post by KentM
Hi Lawrence,
I just e-mailed you the logs you requested below. The e-mail has a 3 MB
attachment. Just letting you know here in case you check this first. I had
some problems with the e-mail address you gave me below, but...it looks like
the e-mail went through. Let me know if you didn't receive it.

Kent, the email did not arrive. It's possible that swbell.net stripped it if
it had a 3MB attachment.

That being the case, an alternate address that WILL accept a 3MB attachment
is:

l a w r e n c e @ e f o r e s t . n e t

[Lawrence Garvin (MVP)]

Post by Lawrence Garvin (MVP)

Post by KentM
Hi Lawrence,
I just e-mailed you the logs you requested below. The e-mail has a 3 MB
attachment. Just letting you know here in case you check this first. I had
some problems with the e-mail address you gave me below, but...it looks like
the e-mail went through. Let me know if you didn't receive it.

Kent, the email did not arrive. It's possible that swbell.net stripped it
if it had a 3MB attachment.

Hey.. here's a wierd thing.. I gave you the wrong email address the first
time, which is why I did not find them in the mailbox I was looking for.

What's even wierder is that the email address I gave you, I thought was not
even configured on my Exchange server... yet it arrived in my inbox anyway..
(maybe it /is/ configured!)

I have them now, and they're on their way to Redmond.

[KentM]

Hi Lawrence,

What happened is the first time I sent you the e-mail, I used the address
you originally specified. However, like you indicated, it was wrong and the
e-mail got bounced back to me. So...I "guessed" at a possible alternative
address that apparently did get through to you: I dumped the "r" in the
e-mail address changing "lrgarvin..." to "lgarvin...". That second e-mail
went through. If it didn't go to a mailbox on the server you expected,
perhaps the "eforce.net" site has a forward setup for the "lgarvin..."
address I used that did go through. Anyway, hope that helps you with the
mystery. ;-)

Thanks again for looking into this,
~Kent

Post by Lawrence Garvin (MVP)
Hey.. here's a wierd thing.. I gave you the wrong email address the first
time, which is why I did not find them in the mailbox I was looking for.
What's even wierder is that the email address I gave you, I thought was not
even configured on my Exchange server... yet it arrived in my inbox anyway..
(maybe it /is/ configured!)
I have them now, and they're on their way to Redmond.

[Mark]

Hi All

Is there any progress on this issue. Something v similiar has happened at
our organisation after patches were pushed down last weekend by WSUS. We are
trying to work out what and why this has happened.

Thanks
Mark

Post by KentM
Hi Lawrence,
What happened is the first time I sent you the e-mail, I used the address
you originally specified. However, like you indicated, it was wrong and the
e-mail got bounced back to me. So...I "guessed" at a possible alternative
address that apparently did get through to you: I dumped the "r" in the
e-mail address changing "lrgarvin..." to "lgarvin...". That second e-mail
went through. If it didn't go to a mailbox on the server you expected,
perhaps the "eforce.net" site has a forward setup for the "lgarvin..."
address I used that did go through. Anyway, hope that helps you with the
mystery. ;-)
Thanks again for looking into this,
~Kent

Post by Lawrence Garvin (MVP)
Hey.. here's a wierd thing.. I gave you the wrong email address the first
time, which is why I did not find them in the mailbox I was looking for.
What's even wierder is that the email address I gave you, I thought was not
even configured on my Exchange server... yet it arrived in my inbox anyway..
(maybe it /is/ configured!)
I have them now, and they're on their way to Redmond.

[KentM]

Hi Mark,

It seems like Lawrence hasn't heard back from the developers at M$ yet.
Otherwise I assume he would have posted something by now. So...I guess we
wait. "Good things come to those who wait." We'll see.

~Kent

Post by Mark
Hi All
Is there any progress on this issue. Something v similiar has happened at
our organisation after patches were pushed down last weekend by WSUS. We are
trying to work out what and why this has happened.
Thanks
Mark

Post by KentM
Hi Lawrence,
What happened is the first time I sent you the e-mail, I used the address
you originally specified. However, like you indicated, it was wrong and the
e-mail got bounced back to me. So...I "guessed" at a possible alternative
address that apparently did get through to you: I dumped the "r" in the
e-mail address changing "lrgarvin..." to "lgarvin...". That second e-mail
went through. If it didn't go to a mailbox on the server you expected,
perhaps the "eforce.net" site has a forward setup for the "lgarvin..."
address I used that did go through. Anyway, hope that helps you with the
mystery. ;-)
Thanks again for looking into this,
~Kent

Post by Lawrence Garvin (MVP)
Hey.. here's a wierd thing.. I gave you the wrong email address the first
time, which is why I did not find them in the mailbox I was looking for.
What's even wierder is that the email address I gave you, I thought was not
even configured on my Exchange server... yet it arrived in my inbox anyway..
(maybe it /is/ configured!)
I have them now, and they're on their way to Redmond.

[Lawrence Garvin (MVP)]

Post by KentM
Hi Mark,
It seems like Lawrence hasn't heard back from the developers at M$ yet.
Otherwise I assume he would have posted something by now. So...I guess we
wait. "Good things come to those who wait." We'll see.

I got something possibly useful just a couple of moments ago.

Marc Shepard pointed me in the direction of KB914810. This KB primarly is
focused on an issue with the WUA misbehaving when the detection interval is
set extremely low (i.e. 2 hours). Specifically the issues were symptomatic
of svchost.exe crashing or having performance issues.

The 'fix' documented in the KB article is a replacement MSI.DLL file.

Given that the most "successful" workaround appears to be blocking or not
using Office updates from WSUS on those affected systems, and Office updates
would be the only product distributed via WSUS that uses MSI to do updates,
I'm thinking this might be a possible issue/fix. That is, those systems may
have defective MSI.DLL files.

Another alternative that I would try before the KB914810 hotfix, though, is
to reinstall the WindowsInstaller 3.1v2 package using the force switch, to
ensure that the lastest release package of WI is fully installed.

And if that doesn't solve the issue.... hang tight, as I understand there's
more 'fixes' in the pipeline. (I don't have a timeframe, though, sorry.)

[Lawrence Garvin (MVP)]

Post by Mark
Hi All
Is there any progress on this issue. Something v similiar has happened at
our organisation after patches were pushed down last weekend by WSUS. We are
trying to work out what and why this has happened.

It's being worked by the dev team.

[CindyWork2000]

Hi Lawrence,

I just wanted to be sure that the development team working on this problem
was aware its not just happening with WUS. We run windows XP (SP2, fully
patched, except for this glitch) machines, doing automatic updates, and we
started seeing this problem August 15th. Turning off Automatic updates makes
the error message go away, but we'd like to be able to turn it back on. The
KB fix file someone mentioned was for window 2003 machines, so doesn't help
us. So far we are only seeing it on our newest batch of PC's, which are Dell
Optiplex GX 620's.

Cheers
Cindy

Post by Lawrence Garvin (MVP)

Post by Mark
Hi All
Is there any progress on this issue. Something v similiar has happened at
our organisation after patches were pushed down last weekend by WSUS. We are
trying to work out what and why this has happened.

It's being worked by the dev team.
--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
.....

[Lawrence Garvin (MVP)]

Post by KentM
Hi Lawrence,
I just wanted to be sure that the development team working on this problem
was aware its not just happening with WUS. We run windows XP (SP2, fully
patched, except for this glitch) machines, doing automatic updates, and we
started seeing this problem August 15th. Turning off Automatic updates makes
the error message go away, but we'd like to be able to turn it back on.
The
KB fix file someone mentioned was for window 2003 machines, so doesn't help
us. So far we are only seeing it on our newest batch of PC's, which are Dell
Optiplex GX 620's.
Cheers
Cindy

Thanks Cindy, but if you're seeing it with AU and it goes away with AU being
shut down, then it's most likely the same type of issue.

It's not a /WSUS/ or /SUS/ or /WU/ or /MU/ issue anyway. It's not about the
source of the updates, but it's about something happening on the client
system after one or more updates are installed. The source of the updates
should be irrelevant, and your observation of the problem when using AU
rather than WSUS supports that belief.

The KB fix I cited, from Marc Shepard, actually comes in flavors for all
platforms, WinXP, Win2003, and Win2000.

Accumulating everything I've seen and read about this scenario, it seems to
be happening as a result of one or more August updates being installed
simultaneously with one or more July updates. It's not affecting any of my
machines. I installed all of the July updates in July. Others have reported
installing July updates in July and August updates in August, with no
effects, but installing July and August updates in recent days has triggered
the situation.

[Derick Schuetz]

Post by KentM
We use WSUS in our campus environment and since either late June or early to
mid-July we have been experiencing this error randomly across our network
client computers (all are Windows XP SP2, fully patched). To the extent that
Automatic Updates is the "problem", it appears to be true that if we disable
this service the error will not appear upon restart. We are not sure,
though, if the Automatic Updates client is THE problem (it WAS updated when
WSUS 2.0 SP1 was installed on our WSUS servers, though - didn't have this
problem with the previous client from WSUS 2.0 RTM), or if some other update
(recent?) is interfering with the Automatic Updates service.
When this particular instance of "svchost.exe" crashes, it takes out about
16 sub-services, but only restores about five of them. As others have
reported, this leaves the machine in a sort of useless state when trying to
run additional programs, access various resources, etc. Has anyone narrowed
this problem any further??? A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly.
And finally I'd like to add that this seems to be a significant/growing
problem popping up in more and more posts, but so far Microsoft has been
suspiciously silent on the subject.

Are you applying Office 2003 updates via WSUS as well? In our analysis this
is what is causing the issue. We have de-approved all Offfice 2003 updates
and are forcing clients to re-detect updates (by manually logging in Local
Admin and running a .bat to force re-detection). This solves the problem.
Well, to be more accurate this does not SOLVE anything, it just makes the
error stop occuring.

[Lawrence Garvin (MVP)]

Post by Derick Schuetz
Are you applying Office 2003 updates via WSUS as well? In our analysis this
is what is causing the issue. We have de-approved all Offfice 2003 updates
and are forcing clients to re-detect updates (by manually logging in Local
Admin and running a .bat to force re-detection). This solves the problem.
Well, to be more accurate this does not SOLVE anything, it just makes the
error stop occuring.

Derick, can you provide some additional detail on the exact scenario you
encountered, and your specific results with disabling Office 2003 updating
via WSUS?

If, in fact, this situation can be tied to an issue with Office updating, it
would be very useful to have specifics.

[Derick Schuetz]

Post by Lawrence Garvin (MVP)
Derick, can you provide some additional detail on the exact scenario you
encountered, and your specific results with disabling Office 2003 updating
via WSUS?
If, in fact, this situation can be tied to an issue with Office updating, it
would be very useful to have specifics.

Unfortunately I do not have much in the way of additional information at
this time. I just know for certain that when our WSUS Administrator pulled
the Office 2003 updates (which we did based on this post
http://www.wsus.info/forums/index.php?showtopic=8166) new systems that were
attempting to install the rest of the updates no longer had issues. This was
a "safe" route for us as we have the option of Updating our Office 2003
clients using SMS.

I made a PSS call today and it sounds like this is happening due to a memory
leak in MSI.DLL - I recieved a hotfix (KB919537) but as we have pulled the
Office 2003 updates from WSUS I no longer have a good environment to TEST
this hotfix. I'll be building another WSUS server and re-creating the "bad"
environment to test as soon as I am able. For the time being you may want to
contact MS for this hotfix, as you may be able to make the determination
using your environment.

[Wyvern]

This seems to have worked for us too. There are a few problematic machines
that are now unstable because of the repeated crashes.

Post by Derick Schuetz

Post by Lawrence Garvin (MVP)
Derick, can you provide some additional detail on the exact scenario you
encountered, and your specific results with disabling Office 2003 updating
via WSUS?
If, in fact, this situation can be tied to an issue with Office updating, it
would be very useful to have specifics.

Unfortunately I do not have much in the way of additional information at
this time. I just know for certain that when our WSUS Administrator pulled
the Office 2003 updates (which we did based on this post
http://www.wsus.info/forums/index.php?showtopic=8166) new systems that were
attempting to install the rest of the updates no longer had issues. This was
a "safe" route for us as we have the option of Updating our Office 2003
clients using SMS.
I made a PSS call today and it sounds like this is happening due to a memory
leak in MSI.DLL - I recieved a hotfix (KB919537) but as we have pulled the
Office 2003 updates from WSUS I no longer have a good environment to TEST
this hotfix. I'll be building another WSUS server and re-creating the "bad"
environment to test as soon as I am able. For the time being you may want to
contact MS for this hotfix, as you may be able to make the determination
using your environment.

[Mark]

Hi All

A bit more detail about our specific problem.

We have 2 seperate WSUS policies running on two different OU's. On one we
deployed the July Security Bulletin patches last month and then the August
ones last weekend - the pc's covered by this policy have not experienced any
major problems (approx 650 pc's). The other OU's had both July and August
patches pushed out last weekend and have experienced problems very similiar
to the ones identified at the start of the thread - svchost errors, services
stopping and soundcards stopping working (Soundmax cards).

After (a lot) of testing we have found that if we uninstall KB914388, reboot
PC, let PC start up and WSUS reapply 914388 it seems to fix the problem. We
are still testing this but I will keep you informed.

Cheers
Mark

Post by Wyvern
This seems to have worked for us too. There are a few problematic machines
that are now unstable because of the repeated crashes.

Post by Derick Schuetz

Post by Lawrence Garvin (MVP)
Derick, can you provide some additional detail on the exact scenario you
encountered, and your specific results with disabling Office 2003 updating
via WSUS?
If, in fact, this situation can be tied to an issue with Office updating, it
would be very useful to have specifics.

Unfortunately I do not have much in the way of additional information at
this time. I just know for certain that when our WSUS Administrator pulled
the Office 2003 updates (which we did based on this post
http://www.wsus.info/forums/index.php?showtopic=8166) new systems that were
attempting to install the rest of the updates no longer had issues. This was
a "safe" route for us as we have the option of Updating our Office 2003
clients using SMS.
I made a PSS call today and it sounds like this is happening due to a memory
leak in MSI.DLL - I recieved a hotfix (KB919537) but as we have pulled the
Office 2003 updates from WSUS I no longer have a good environment to TEST
this hotfix. I'll be building another WSUS server and re-creating the "bad"
environment to test as soon as I am able. For the time being you may want to
contact MS for this hotfix, as you may be able to make the determination
using your environment.

[Wyvern]

Ours were pushed out as per your first policy, July patches in July and
August last week. Sound cards are varied but mainly AC97 with a couple of
SoundMax. We were applying 914388 manually and this appeared to work but
some of those fell over last week and one I was working on didn't work at all.

I won't know how thing fully went until I get in on Monday.

Will try to keep you all posted

Post by Mark
Hi All
A bit more detail about our specific problem.
We have 2 seperate WSUS policies running on two different OU's. On one we
deployed the July Security Bulletin patches last month and then the August
ones last weekend - the pc's covered by this policy have not experienced any
major problems (approx 650 pc's). The other OU's had both July and August
patches pushed out last weekend and have experienced problems very similiar
to the ones identified at the start of the thread - svchost errors, services
stopping and soundcards stopping working (Soundmax cards).
After (a lot) of testing we have found that if we uninstall KB914388, reboot
PC, let PC start up and WSUS reapply 914388 it seems to fix the problem. We
are still testing this but I will keep you informed.
Cheers
Mark

Post by Wyvern
This seems to have worked for us too. There are a few problematic machines
that are now unstable because of the repeated crashes.

Post by Derick Schuetz

Post by Lawrence Garvin (MVP)
Derick, can you provide some additional detail on the exact scenario you
encountered, and your specific results with disabling Office 2003 updating
via WSUS?
If, in fact, this situation can be tied to an issue with Office updating, it
would be very useful to have specifics.

Unfortunately I do not have much in the way of additional information at
this time. I just know for certain that when our WSUS Administrator pulled
the Office 2003 updates (which we did based on this post
http://www.wsus.info/forums/index.php?showtopic=8166) new systems that were
attempting to install the rest of the updates no longer had issues. This was
a "safe" route for us as we have the option of Updating our Office 2003
clients using SMS.
I made a PSS call today and it sounds like this is happening due to a memory
leak in MSI.DLL - I recieved a hotfix (KB919537) but as we have pulled the
Office 2003 updates from WSUS I no longer have a good environment to TEST
this hotfix. I'll be building another WSUS server and re-creating the "bad"
environment to test as soon as I am able. For the time being you may want to
contact MS for this hotfix, as you may be able to make the determination
using your environment.

[Lawrence Garvin (MVP)]

Post by Wyvern
Ours were pushed out as per your first policy, July patches in July and
August last week. Sound cards are varied but mainly AC97 with a couple of
SoundMax. We were applying 914388 manually and this appeared to work but
some of those fell over last week and one I was working on didn't work at all.

Since the sound card failure is mentioned, I must ask if sound card drivers
were delivered in the July or August updates to any of these systems?

Just as a side note.. I highly recommend NOT installing hardware drivers via
WSUS, or WU/MU. While I have had reasonable success installing network card
drivers from Windows Update, I've had significant negative issues installing
audio and video drivers, as have many others.

The conventional wisdom of many is to obtain all hardware drivers direct
from the OEM/Vendor, not from Microsoft.

Aside from that, it's arguable that a business class machine has any real
need for the updating of audio or video drivers anyway. Typically those
driver 'updates' are feature-based, and involve features that will not
likely be used on a business-class machine anyway.

As for the significance of 914388.. this one has me intrigued. It does cut a
wide swath in fixing networking components, and is primarily targeted at
issues in the DHCP subsystem, but I can't for the life of me imagine why or
how an update to the DHCP or TCP/IP stack would affect the stability of the
svchost.exe -- unless it happens to be that the DHCP client service is
running in /that/ svchost process. It could well be a 'bug' in the update
installation process that's only manifesting when installed in combination
with one or more additional updates.

btw, I did forward Mark's post to the WUA dev team for their review and
analysis.

[Wyvern]

For us, the drivers are the original installed from the manufacturer and
built into our SOE. I think the reason for the inclusion of sound cards in
Mark's posting is that the audio service fails and is one of the more
noticable problems for the end user apart from difficulties getting around
the network. One of the more common issues being reported to our helpdesk
was 'Sound not working'. When we would follow up everything fell into place;
email not working and svchost errors etc. Many of our users seem to get
distressed if they can't listen to their CDs.

Post by Lawrence Garvin (MVP)

Post by Wyvern
Ours were pushed out as per your first policy, July patches in July and
August last week. Sound cards are varied but mainly AC97 with a couple of
SoundMax. We were applying 914388 manually and this appeared to work but
some of those fell over last week and one I was working on didn't work at all.

Since the sound card failure is mentioned, I must ask if sound card drivers
were delivered in the July or August updates to any of these systems?
Just as a side note.. I highly recommend NOT installing hardware drivers via
WSUS, or WU/MU. While I have had reasonable success installing network card
drivers from Windows Update, I've had significant negative issues installing
audio and video drivers, as have many others.
The conventional wisdom of many is to obtain all hardware drivers direct
from the OEM/Vendor, not from Microsoft.
Aside from that, it's arguable that a business class machine has any real
need for the updating of audio or video drivers anyway. Typically those
driver 'updates' are feature-based, and involve features that will not
likely be used on a business-class machine anyway.
As for the significance of 914388.. this one has me intrigued. It does cut a
wide swath in fixing networking components, and is primarily targeted at
issues in the DHCP subsystem, but I can't for the life of me imagine why or
how an update to the DHCP or TCP/IP stack would affect the stability of the
svchost.exe -- unless it happens to be that the DHCP client service is
running in /that/ svchost process. It could well be a 'bug' in the update
installation process that's only manifesting when installed in combination
with one or more additional updates.
btw, I did forward Mark's post to the WUA dev team for their review and
analysis.
--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
.....

[Les Connor [SBS Community Member - SBS MVP]]

I've had similar issues, but with a different error reported in WSUS.

The similarities are the workstations are all Dell, and mostly Optiplex. The
WSUS install was fresh in July, and the workstations were a long way from
current patch levels. The issue started with August updates.

From another thread started by me:

(on the workstations) There is a svchost.exe process at 265,000 k.

AudioSrv, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, helpsvc,
lanmanserver, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon,
SENS, SharedAccess, ShellHWDetection, srservice, TapiSrv, Themes, TrkWks,
W32Time, winmgmt, wscsvc, wuauserv, WZCSVC.

The errors in the workstation logs, and the one reported in WSUS, is
0x8007000E - out of memory. There is an automatic update cannot be contacted
error in the ws event logs.

I've tried various resolutions without success, but this one seems to have
done the trick, so far (been 3 days now).

On the workstation, run WU, and convert to MU.
Active-X is installed, and Search for Updates fails and cannot be resolved
without a restart.
Once restarted, Search for Updates (MU) identifies Genuine Advantage,
install that.
Once installed - GA Notification Tool is identified, install that - restart
required.
Once restarted, MU succeeds in identifying updates required - don't install.
Error clears in the WSUS console, and updates are successfully processed
from the WSUS server.

This kind of manual intervention isn't a good solution in an enterprise
environment, but in this one case where I had 17 workstations with the same
error condition, it was possible - allthough it was a PITA.
--
Les Connor [SBS Community Member - SBS MVP]
-----------------------------------------------------------
SBS Rocks !
----------------------
"Tell me and I'll forget. Show me and I'll remember. Involve me and I'll
understand." - Confucius

Post by Lawrence Garvin (MVP)

Post by Wyvern
Ours were pushed out as per your first policy, July patches in July and
August last week. Sound cards are varied but mainly AC97 with a couple of
SoundMax. We were applying 914388 manually and this appeared to work but
some of those fell over last week and one I was working on didn't work at all.

Since the sound card failure is mentioned, I must ask if sound card
drivers were delivered in the July or August updates to any of these
systems?
Just as a side note.. I highly recommend NOT installing hardware drivers
via WSUS, or WU/MU. While I have had reasonable success installing network
card drivers from Windows Update, I've had significant negative issues
installing audio and video drivers, as have many others.
The conventional wisdom of many is to obtain all hardware drivers direct
from the OEM/Vendor, not from Microsoft.
Aside from that, it's arguable that a business class machine has any real
need for the updating of audio or video drivers anyway. Typically those
driver 'updates' are feature-based, and involve features that will not
likely be used on a business-class machine anyway.
As for the significance of 914388.. this one has me intrigued. It does cut
a wide swath in fixing networking components, and is primarily targeted at
issues in the DHCP subsystem, but I can't for the life of me imagine why
or how an update to the DHCP or TCP/IP stack would affect the stability of
the svchost.exe -- unless it happens to be that the DHCP client service is
running in /that/ svchost process. It could well be a 'bug' in the update
installation process that's only manifesting when installed in combination
with one or more additional updates.
btw, I did forward Mark's post to the WUA dev team for their review and
analysis.
--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
....

[Suffering home user]

Please help I only have a home computer but this problem is driving me mad it
keeps changing my computer settings and shutting down anything I do.

Post by KentM
We use WSUS in our campus environment and since either late June or early to
mid-July we have been experiencing this error randomly across our network
client computers (all are Windows XP SP2, fully patched). To the extent that
Automatic Updates is the "problem", it appears to be true that if we disable
this service the error will not appear upon restart. We are not sure,
though, if the Automatic Updates client is THE problem (it WAS updated when
WSUS 2.0 SP1 was installed on our WSUS servers, though - didn't have this
problem with the previous client from WSUS 2.0 RTM), or if some other update
(recent?) is interfering with the Automatic Updates service.
When this particular instance of "svchost.exe" crashes, it takes out about
16 sub-services, but only restores about five of them. As others have
reported, this leaves the machine in a sort of useless state when trying to
run additional programs, access various resources, etc. Has anyone narrowed
this problem any further??? A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly.
And finally I'd like to add that this seems to be a significant/growing
problem popping up in more and more posts, but so far Microsoft has been
suspiciously silent on the subject.

[Wyvern]

Turn off and remove Office updates from your WSUS server and see if that
helps. It appears that this is the cause of the issue.

Post by Suffering home user
Please help I only have a home computer but this problem is driving me mad it
keeps changing my computer settings and shutting down anything I do.

Post by KentM
We use WSUS in our campus environment and since either late June or early to
mid-July we have been experiencing this error randomly across our network
client computers (all are Windows XP SP2, fully patched). To the extent that
Automatic Updates is the "problem", it appears to be true that if we disable
this service the error will not appear upon restart. We are not sure,
though, if the Automatic Updates client is THE problem (it WAS updated when
WSUS 2.0 SP1 was installed on our WSUS servers, though - didn't have this
problem with the previous client from WSUS 2.0 RTM), or if some other update
(recent?) is interfering with the Automatic Updates service.
When this particular instance of "svchost.exe" crashes, it takes out about
16 sub-services, but only restores about five of them. As others have
reported, this leaves the machine in a sort of useless state when trying to
run additional programs, access various resources, etc. Has anyone narrowed
this problem any further??? A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly.
And finally I'd like to add that this seems to be a significant/growing
problem popping up in more and more posts, but so far Microsoft has been
suspiciously silent on the subject.

[Frank]

I've ran in to the same issue, not on all the computers just some.

What's worked for me:

Just as you login to the computer bring up the task manager and sort by
memory or CPU usage

Then find the svchost process and kill it, it should be the most active
process.

From the command line type wuauclt /detectnow, I have this in a batch

file.
This forces an update from WSUS, when choosing the update type choose
express.

Good luck, hope MS fixes the issue.

Frank

We use WSUS in our campus environment and since either late June or early to
mid-July we have been experiencing this error randomly across our network
client computers (all are Windows XP SP2, fully patched). To the extent that
Automatic Updates is the "problem", it appears to be true that if we disable
this service the error will not appear upon restart. We are not sure,
though, if the Automatic Updates client is THE problem (it WAS updated when
WSUS 2.0 SP1 was installed on our WSUS servers, though - didn't have this
problem with the previous client from WSUS 2.0 RTM), or if some other update
(recent?) is interfering with the Automatic Updates service.
When this particular instance of "svchost.exe" crashes, it takes out about
16 sub-services, but only restores about five of them. As others have
reported, this leaves the machine in a sort of useless state when trying to
run additional programs, access various resources, etc. Has anyone narrowed
this problem any further??? A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly.
And finally I'd like to add that this seems to be a significant/growing
problem popping up in more and more posts, but so far Microsoft has been
suspiciously silent on the subject.

[Greg]

This may seem all to simplistic to the problem, but I was crusing through
some forum and found this advice. It works for several months, now I am
getting the same problem again. I was just about to give it another shot,
but was looking for a more permenant solution. You might want to read the
info in the following forum, give it a try.

http://www.infohq.com/cgi-bin/ikonboard/topic.cgi?forum=4&topic=181

Good Luck

Greg

Post by KentM
We use WSUS in our campus environment and since either late June or early to
mid-July we have been experiencing this error randomly across our network
client computers (all are Windows XP SP2, fully patched). To the extent that
Automatic Updates is the "problem", it appears to be true that if we disable
this service the error will not appear upon restart. We are not sure,
though, if the Automatic Updates client is THE problem (it WAS updated when
WSUS 2.0 SP1 was installed on our WSUS servers, though - didn't have this
problem with the previous client from WSUS 2.0 RTM), or if some other update
(recent?) is interfering with the Automatic Updates service.
When this particular instance of "svchost.exe" crashes, it takes out about
16 sub-services, but only restores about five of them. As others have
reported, this leaves the machine in a sort of useless state when trying to
run additional programs, access various resources, etc. Has anyone narrowed
this problem any further??? A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly.
And finally I'd like to add that this seems to be a significant/growing
problem popping up in more and more posts, but so far Microsoft has been
suspiciously silent on the subject.

[Greg]

I may be a little late here, but I've experience the SCVHOST error problem
and I found a forum that offered a suggestion and it's worked for me...at
least for a few months now, but it's come back. I'm fixing to implement it
again. Anyway, might consider what you read on the following link.

http://www.infohq.com/cgi-bin/ikonboard/topic.cgi?forum=4&topic=181

Thanks,
Greg

Post by KentM
We use WSUS in our campus environment and since either late June or early to
mid-July we have been experiencing this error randomly across our network
client computers (all are Windows XP SP2, fully patched). To the extent that
Automatic Updates is the "problem", it appears to be true that if we disable
this service the error will not appear upon restart. We are not sure,
though, if the Automatic Updates client is THE problem (it WAS updated when
WSUS 2.0 SP1 was installed on our WSUS servers, though - didn't have this
problem with the previous client from WSUS 2.0 RTM), or if some other update
(recent?) is interfering with the Automatic Updates service.
When this particular instance of "svchost.exe" crashes, it takes out about
16 sub-services, but only restores about five of them. As others have
reported, this leaves the machine in a sort of useless state when trying to
run additional programs, access various resources, etc. Has anyone narrowed
this problem any further??? A "liz" has kindly been referring others with
this problem to a particular solution that is fine for a home or small
office/business user, but that solution does not work for those of us in a
large environment with thousands of computers updating from WSUS directly.
And finally I'd like to add that this seems to be a significant/growing
problem popping up in more and more posts, but so far Microsoft has been
suspiciously silent on the subject.

[CJB]

With regards to the dreaded 0x745f2780 'bug' on my PC - this is an
issue with the Pentium chip apparently and MS auto-updating of patches
failing to complete for some reason.

When asked Toshiba CS told me that re-building the PC - a nightmare
scenario - was the only solution and that this was caused by a virus.
THEY WERE WRONG.

Apparently the problem occurs when an auto-update from MS fails or is
stopped. This is likely since some of these updates can be up to 50Mb
and take 30 minutes!! The solution is to switch this auto-updating off
(Control Panel / Windows Auto-Update / Off), start up I.E. and then go
to the MS update site. Then request that this searches the laptop / PC
for files needing updating. This will recommend high priority updates.
Choose all of these and then manually initiate the downloads and
installations. Wait until all have been completed. Then go back to
Control Panel and switch auto-updating on again.

This worked for me and was a far better solution that re-building the
damned thing!!!

Also the question has to be asked as to why there is no mention of this
'bug' on the MS website not even in their Knowledge Base.

CJB.

[Lawrence Garvin (MVP)]

Post by CJB
With regards to the dreaded 0x745f2780 'bug' on my PC - this is an
issue with the Pentium chip apparently and MS auto-updating of patches
failing to complete for some reason.

I'd be interested in knowing where you got your information that /hardware/
has anything at all to do with this issue.

Post by CJB
Apparently the problem occurs when an auto-update from MS fails or is
stopped.

Likewise, this is "new" information as well... to the best of my knowledge
this problem is caused because of an issue in the MSI.DLL file, and nothing
else, and has been typically triggered as a function of Office 2003 update
installations.

Post by CJB
The solution is to switch this auto-updating off
(Control Panel / Windows Auto-Update / Off), start up I.E. and then go
to the MS update site. Then request that this searches the laptop / PC
for files needing updating. This will recommend high priority updates.
Choose all of these and then manually initiate the downloads and
installations. Wait until all have been completed. Then go back to
Control Panel and switch auto-updating on again.

That's certainly a workaround.

But hardly a solution.

Post by CJB
Also the question has to be asked as to why there is no mention of this
'bug' on the MS website not even in their Knowledge Base.

Try this http://support.microsoft.com/kb/914810

[JohnG]

Post by Lawrence Garvin (MVP)
Try this http://support.microsoft.com/kb/914810

Lawrence,

I am experiencing this problem on numerous computers, and have spent
many frustrating hours trying to fix it.

I have read all your responses, so thanks for your efforts in trying to
find a solution.

Clearly this is a Microsoft-induced problem.

The question now is, how do we get this updated MSI.DLL without each of
us having to pay Microsoft $245 (and a long tech-support call) just for
the privilege of asking for it?

As an alternative, how do we get Microsoft's attention to provide an
automatic update that fixes the problem?

John Gruener
Americomp, Inc.

[Les Connor [SBS Community Member - SBS MVP]]

Call MS again, and tell them right off the hop you want the hotfix
referenced in article # xxxxx, and you won't be charged.
--
Les Connor [SBS Community Member - SBS MVP]
-----------------------------------------------------------
SBS Rocks !
----------------------
"Tell me and I'll forget. Show me and I'll remember. Involve me and I'll
understand." - Confucius

Post by KentM

Post by Lawrence Garvin (MVP)
Try this http://support.microsoft.com/kb/914810

Lawrence,
I am experiencing this problem on numerous computers, and have spent
many frustrating hours trying to fix it.
I have read all your responses, so thanks for your efforts in trying to
find a solution.
Clearly this is a Microsoft-induced problem.
The question now is, how do we get this updated MSI.DLL without each of
us having to pay Microsoft $245 (and a long tech-support call) just for
the privilege of asking for it?
As an alternative, how do we get Microsoft's attention to provide an
automatic update that fixes the problem?
John Gruener
Americomp, Inc.

[JohnG]

Post by Les Connor [SBS Community Member - SBS MVP]
Call MS again, and tell them right off the hop you want the hotfix
referenced in article # xxxxx, and you won't be charged.

Thanks Les.

To be clear, I'm not using WSUS, but get this error on every
auto-update that occurs at shutdown. At boot time I get the Generic
Host Process error that explains the error occurred at shutdown time.

I will call MS Monday, 9-18, get the hotfix and install it. After the
next auto-update (which will be shortly thereafter for Windows
Defender) I will report here success or failure.

John Gruener
Americomp, Inc.

[CogX]

Post by Les Connor [SBS Community Member - SBS MVP]
Call MS again, and tell them right off the hop you want the hotfix
referenced in article # xxxxx, and you won't be charged.

Well, I contacted MS two weeks about this same problem happening on around
30 out of 160 XPsp2 systems and I asked for the patch, but they wouldn't
give it to me. I was told to try to add svchost.exe to the DEP exclusion
list, but I had already manually updated all of my problem systems, sucking
up hours I didn't have available to do it.

Well, with the addition of the VML patch, same error yet again on some of
my systems, even with the svchost.exe as a DEP exclusion. MSXML3.dll is
current with SP7 and registered properly, as are all of the WUA* and
related files, I've tried it all folks.

I'm actually doubting there is any such hotfix, because certainly after two
weeks, my MS support contact would have found it in their database and sent
it to me. It very well could be the mysterious hotfix posted about might
really fix a memory leak or whatnot, but I'm not convinced that if I had it
right now that the system I have right next to me getting this error would
magically stop crashing upon every boot.

[Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]]

I have this hotfix.... where are you located?

Post by CogX

Post by Les Connor [SBS Community Member - SBS MVP]
Call MS again, and tell them right off the hop you want the hotfix
referenced in article # xxxxx, and you won't be charged.

Well, I contacted MS two weeks about this same problem happening on around
30 out of 160 XPsp2 systems and I asked for the patch, but they wouldn't
give it to me. I was told to try to add svchost.exe to the DEP exclusion
list, but I had already manually updated all of my problem systems, sucking
up hours I didn't have available to do it.
Well, with the addition of the VML patch, same error yet again on some of
my systems, even with the svchost.exe as a DEP exclusion. MSXML3.dll is
current with SP7 and registered properly, as are all of the WUA* and
related files, I've tried it all folks.
I'm actually doubting there is any such hotfix, because certainly after two
weeks, my MS support contact would have found it in their database and sent
it to me. It very well could be the mysterious hotfix posted about might
really fix a memory leak or whatnot, but I'm not convinced that if I had it
right now that the system I have right next to me getting this error would
magically stop crashing upon every boot.

[JohnG]

Post by Lawrence Garvin (MVP)
Try this http://support.microsoft.com/kb/914810

OK Lawrence, I got the hotfix and installed it, then restarted (no
updates pending).

Verified that a new MSI.DLL (4-4-06) was installed.

Later, got a Windows Defender update pending.

Shut down, update started, then got a new error code:

"svchost.exe - Application Error
The instruction at '0x476122d0' referenced memory at '0x00000000'. The
memory could not be read".

On restart got the same Generic Host Process for Win32 error as before,
indicating the error occurred at shutdown time.

Now what?

John Gruener
Americomp, Inc.

[CogX]

Post by JohnG

Post by Lawrence Garvin (MVP)
Try this http://support.microsoft.com/kb/914810

OK Lawrence, I got the hotfix and installed it, then restarted (no
updates pending).
Verified that a new MSI.DLL (4-4-06) was installed.
Later, got a Windows Defender update pending.
"svchost.exe - Application Error
The instruction at '0x476122d0' referenced memory at '0x00000000'. The
memory could not be read".
On restart got the same Generic Host Process for Win32 error as before,
indicating the error occurred at shutdown time.
Now what?
John Gruener
Americomp, Inc.

Hey John, in the same boat as you. My MS support contact said to add
SVCHOST.EXE as a DEP exclusion. I tried it and it still crashed on at
least this one system I've been working on today, with the new VML patch
trying to install via Automatic Updates. I assume I'll have this problem
on many more systems now today.

Out of curiosity, what brand and version of AV software do you have
installed?

[JohnG]

Post by CogX
Hey John, in the same boat as you. My MS support contact said to add
SVCHOST.EXE as a DEP exclusion. I tried it and it still crashed on at
least this one system I've been working on today, with the new VML patch
trying to install via Automatic Updates. I assume I'll have this problem
on many more systems now today.
Out of curiosity, what brand and version of AV software do you have
installed?

I have McAfee installed on all but two. I'm sure AV is not a factor
though, because one of those exceptions is my own brand new Dell
notebook (D820), which I ordered from Dell without AV, and on which I
have not yet installed any AV. The other is an OEM master with all
patches regularly applied, and no AV installed. These obviously have
very different origins, yet both have this problem.

On my notebook computer the Windows updates were applied August 13, but
included many older updates, since the image from Dell apparently had
not been updated in a long time. The next day I installed Office 2003
SP2, and then 9 updates. So the Office updates were not applied at the
same time as Windows, which some have suggested as a common factor.

All other computers have McAfee installed, and have been updated on a
regular basis. The error began to occur after the August updates.
However, in case this is a common factor, it is possible that all the
computers affected, including the OEM master, had the July or earlier
updates applied at the same time as the August updates. I will have to
research this further if it becomes important.

To troubleshoot this I have deactivated all non-Microsoft startup
programs, services, drivers, handlers, components, BHOs, shell
extensions, toolbars, etc., as well as some 20 or so Microsoft services
that I don't need. I restarted and verified that none of these were
running. I then shut down allowing the update to install and still got
this error. I am therefore quite convinced that this is purely a
Microsoft problem unrelated to any third-party application.

After installing the 914810 MSI.DLL hotfix recommended by Lawrence, the
error changed to '0x476122d0'. I have now uninstalled that hotfix, and
the error has reverted to the original '0x745f2780'. This would
indicate to me that MSI.DLL is very much involved with this error. This
was, however, not replaced in any recent updates, so obviously there is
some interaction with another component that was replaced.

John Gruener
Americomp, Inc.

[CogX]

Post by JohnG
I have McAfee installed on all but two. I'm sure AV is not a factor
though, because one of those exceptions is my own brand new Dell
notebook (D820), which I ordered from Dell without AV, and on which I
have not yet installed any AV. The other is an OEM master with all
patches regularly applied, and no AV installed. These obviously have
very different origins, yet both have this problem.
On my notebook computer the Windows updates were applied August 13,
but included many older updates, since the image from Dell apparently
had not been updated in a long time. The next day I installed Office
2003 SP2, and then 9 updates. So the Office updates were not applied
at the same time as Windows, which some have suggested as a common
factor.
All other computers have McAfee installed, and have been updated on a
regular basis. The error began to occur after the August updates.
However, in case this is a common factor, it is possible that all the
computers affected, including the OEM master, had the July or earlier
updates applied at the same time as the August updates. I will have to
research this further if it becomes important.
To troubleshoot this I have deactivated all non-Microsoft startup
programs, services, drivers, handlers, components, BHOs, shell
extensions, toolbars, etc., as well as some 20 or so Microsoft
services that I don't need. I restarted and verified that none of
these were running. I then shut down allowing the update to install
and still got this error. I am therefore quite convinced that this is
purely a Microsoft problem unrelated to any third-party application.
After installing the 914810 MSI.DLL hotfix recommended by Lawrence,
the error changed to '0x476122d0'. I have now uninstalled that hotfix,
and the error has reverted to the original '0x745f2780'. This would
indicate to me that MSI.DLL is very much involved with this error.
This was, however, not replaced in any recent updates, so obviously
there is some interaction with another component that was replaced.
John Gruener
Americomp, Inc.

This problem is just so completely frustrating. The only thing I was able
to find that finally let me boot without the svchost.exe fault (0x745f2780)
was to disable the "Symantec SPBBCSvc" service and "Symantec AntiVirus
Definition Watcher" service, reboot, and the problem FINALLY went away. I
re-enabled those services, rebooted, and the problem has stayed away.
Before I had disabled those two services, however, I had also tried
disabling some other services, changed AU settings, anything I could think
of that I had or hadn't tried last week, and it wasn't until I disabled
those two Symantec services that things cleared up. Apparently that also
is a coincidence? Or maybe not, but that this is only the reason on my
systems?

Also, on most of my systems, the key to getting the svchost.exe fault to go
away is to get the pending updates installed manually. Most of the time
that has been the "solution", but not always. This system had no problems
with the September 12 updates, even though many of my other systems did.
However, this one computer then decided to choke on the VML patch from this
past week, while none of the others did that I've discovered.
Unbelievable. So, basically, starting in August 2006, every Patch Tuesday
is going to give me some random % of my systems that will have this error
and not even the same systems month to month, but apparently just
completely at random?

Oh, and I had specifically asked for the 914810 MSI.DLL hotfix, even
pasting in the URL to these discussions and releveant parts of these
various discussions, but Microsoft Support would not give it to me.
Unfortunately, adding SVCHOST.EXE to the DEP exclusion list did not help at
all, which was what they told me to do.

This had never been a problem for me, before the July patches were
released. After the July patches, though, the only change on all of my
systems is that the wua* program files (wuaueng.dll, wuauclt.exe, etc.)
were updated to the newer 5.8.0.2607 build (as part of the WSUS SP1 update
this summer).

I assume, however, not everyone has that build, but that some systems are
also having the svchost fault with the common 5.8.0.2469 build? Yes?

Assuming the answer is yes, that only leaves system files modified with
the June 2006 patch set...

[JohnG]

I'm stumped and quite frustrated.

I now have over a dozen computers under my management that have this
error, and the number is growing.

How can I fix this?

How can we get someone at Microsoft to give some attention to solving
this problem?

If none of the MVPs here can solve this, can any of them help to get
Microsoft's attention?

I'm fully willing to work with any MS engineer who can help diagnose
this problem and get a resolution.

Thanks in advance to anyone who can help.

John Gruener
Americomp, Inc.

[JohnG]

I have now attempted the fix recommended by Mark on August 17,
uninstalling the July update 914388. After reboot this update became
scheduled, along with 920683 (which had previously been installed and
was not uninstalled). At shutdown the update process failed again with
this same error.

I then restarted and installed these two manually, leaving a Windows
Defender update uninstalled.

I then shutdown, allowing the Defender update to install, and got this
same svchost.exe error.

Conclusion: Uninstalling 914388 does not fix it, and reinstalling it
does not fix it.

Again, this is using MS AU, not WSUS, but the problem seems to be
independent of the update method. If any pending update is attempted at
shutdown (rather than while Windows is running) this error occurs.

John Gruener
Americomp, Inc.