Windows Update / SvcHost.exe 100% Cpu in task manager

Anonymous

This problem I know is not new to too many of us. Yet - this is November 2013 and I would like to know how this happened AND what to do to fix it!

I have built many computers since 1997. I never had this problem arise until this reinstall. Have reinstalled XP to XPSP3 several times.

Let us not waste time questioning my knowledge.

Same: components, Motherboard, memory, NOTHING HAS CHANGED. The only thing that is different IS - when I have completed the Windows XP install to Windows XPSP3 - tested functionality - fast as **** - reviewed 'EVENT VIEWER' - no issues, constantly checking the processor usage - low. My next step to activate Windows update to get the updates to make my system secure. Sure enough the CPU spikes to 100% - due to a service host CPU demand! I have to say - IF the meter would have a parameter to 200% - I do not doubt it would go higher than 100%.

Even though I do not doubt the correctness of my process to install the OS (again I have done many times throughout the years) I decided since I have not loaded anything else - I would format the drive (Nov 19) and start all over again.

I sit here now with a computer box with verified functioning components, With a properly installed OS, Motherboard drivers installed - nothing else done and I can not get windows updates.

Note: the first attempt install (Nov 17) - I tried the advice on the Microsoft sites, the fix it routine, the recommended installing of a version of net framework to no avail. There is also other advice to perform a routine (don't ask - I do not desire to dig up that data) in 'safe mode' that also failed to remedy this. Frankly I rarely use advice from even the recognized experts out there but I decided whether it worked or not - as I desired a fresh install one last time to have a properly functioning computer that I built myself and gift it. I'm getting old - at a time of my life when one begins to reduce their material possessions.

How is it possible that someone can do something so many times with certainty to have this issue and to read so many are dumbfounded with this?!

And spare me the absurdity of checking for malware, virus, bad drivers. This computer has not had any exposure to have these issues!

One can safely assume it is not an issue with hardware - even working correctly - as many with this same issue described components that are widely different.

My deduction is: Something is amiss at Microsoft update center and or Windows update I have tried both! I believe (leaving out the suggestions by some of shenanigans) too much is trying to get through - after all the updates number about 120 give or take a few.

Anyway - If there is any assistance 'out there' to provide an answer to a Microsoft customer that bought Windows3.1; Windows95; Windows98; Windows Millennia; Windows Xp. Windows Vista on my Wife's computer. Windows 7 on my recent build just for music enjoyment - I would like the courtesy of receiving a solution to this issue.

It seems very simple to me for someone at Microsoft to round up the most important of Security updates - place them on a disk (compressed - many of us have WinZip and large hard drives) and provide them to us with ONLY A CHARGE FOR POSTAGE - OK, OK add a dollar or two. Leave out the fixes for the fixes. You should know what we need. Buying new hardware or OS systems is out of the question WHY? Because either we can not afford it and most of all - WE OUT HERE ARE STANDING BY a Microsoft product that WE believe in!

Try to do it in time for Christmas - it will do a lot for Microsoft's image .

Have a Good Thanksgiving to all!

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

This problem I know is not new to too many of us. Yet - this is November 2013 and I would like to know how this happened AND what to do to fix it! I have built many computers since 1997. I never had this problem arise until this reinstall. Have reinstalled XP to XPSP3 several times. Let us not waste time questioning my knowledge. Same: components, Motherboard, memory, NOTHING HAS CHANGED. The only thing that is different IS - when I have completed the Windows XP install to Windows XPSP3 - tested functionality - fast as **** - reviewed 'EVENT VIEWER' - no issues, constantly checking the processor usage - low. My next step to activate Windows update to get the updates to make my system secure. Sure enough the CPU spikes to 100% - due to a service host CPU demand! I have to say - IF the meter would have a parameter to 200% - I do not doubt it would go higher than 100%. Even though I do not doubt the correctness of my process to install the OS (again I have done many times throughout the years) I decided since I have not loaded anything else - I would format the drive (Nov 19) and start all over again. I sit here now with a computer box with verified functioning components, With a properly installed OS, Motherboard drivers installed - nothing else done and I can not get windows updates. Note: the first attempt install (Nov 17) - I tried the advice on the Microsoft sites, the fix it routine, the recommended installing of a version of net framework to no avail. There is also other advice to perform a routine (don't ask - I do not desire to dig up that data) in 'safe mode' that also failed to remedy this. Frankly I rarely use advice from even the recognized experts out there but I decided whether it worked or not - as I desired a fresh install one last time to have a properly functioning computer that I built myself and gift it. I'm getting old - at a time of my life when one begins to reduce their material possessions. How is it possible that someone can do something so many times with certainty to have this issue and to read so many are dumbfounded with this?! And spare me the absurdity of checking for malware, virus, bad drivers. This computer has not had any exposure to have these issues! One can safely assume it is not an issue with hardware - even working correctly

as many with this same issue described components that are widely different. My deduction is: Something is amiss at Microsoft update center and or Windows update I have tried both! I believe (leaving out the suggestions by some of shenanigans) too much is trying to get through - after all the updates number about 120 give or take a few. Anyway - If there is any assistance 'out there' to provide an answer to a Microsoft customer that bought Windows3.1; Windows95; Windows98; Windows Millennia; Windows Xp. Windows Vista on my Wife's computer. Windows 7 on my recent build just for music enjoyment - I would like the courtesy of receiving a solution to this issue. It seems very simple to me for someone at Microsoft to round up the most important of Security updates - place them on a disk (compressed - many of us have WinZip and large hard drives) and provide them to us with ONLY A CHARGE FOR POSTAGE - OK, OK add a dollar or two. Leave out the fixes for the fixes. You should know what we need. Buying new hardware or OS systems is out of the question WHY? Because either we can not afford it and most of all - WE OUT HERE ARE STANDING BY a Microsoft product that WE believe in! Try to do it in time for Christmas - it will do a lot for Microsoft's image . Have a Good Thanksgiving to all!

Hi Joseph,

Please do the following.

Go to Start | Settings | Control Panel and double click Automatic Updates.

Checkmark the bottom option to disable automatic updates.

Click Apply/OK and then reboot.

Does svchost still consume 100% CPU cycles?

If it does, do the following.

Go to Start, Run, copy/paste this command and click OK: services.msc

In the list of Services, can you see Background Intelligent Transfer Service ?

Here's a pix of what it looks like.

If it's not listed, please proceed as follows to register the BITS service.

Open the Windows Search tool, copy/paste the following and then click Search: qmgr.dll

Search should show that file in the following locations:

C:\WINDOWS\system32

C:\WINDOWS\ServicePackFiles\i386

C:\WINDOWS\system32\bits

It may only be present in C:\WINDOWS\system32, but provided you can see it, do the following to register the service.

Go to Start, Run and copy/paste: regsvr32 qmgr.dll and click OK

Do the same with this file: regsvr32 qmgrprxy.dll

Reboot the system and then copy/paste this command into the Run field:

%windir%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %windir%\inf\qmgr.inf

If you're prompted to insert the Windows installation CD, ignore that and in the dialog box at the bottom, change the path to C:\WINDOWS\ServicePackFiles\i386

If you could only see qmgr.dll in C:\WINDOWS\system32 change the path to that instead.

Restart the PC again and then go to Services and you should be able to see BITS in the list.

Double click it and then on the General tab, click the Start button to try and start the service manually. This is just a test to ensure that it's working correctly.

If you get Error 2: cannot find the file specified, go to Start, then Run again and copy/paste the following command and then click OK:

Reg add HKLM\SYSTEM\CurrentControlSet\Services\BITS\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %windir%\System32\qmgr.dll

Reboot again and then try once more to start BITS. It should work properly now, but in the unlikely event that it fails again, run the following command and then hit Enter:

Reg add HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup

Reboot once more and then do the following.

Go to this link and install the IE8 cumulative December update:

http://www.microsoft.com/en-gb/download/details.aspx?id=41404

If you use IE7, use this link instead:

http://www.microsoft.com/en-gb/download/details.aspx?id=41442

Finally, go to the Windows Update site and you should be able to download normally.

0 comments

159 additional answers

Anonymous

2013-11-20T18:16:44+00:00

Yes I believe we are seeing a variant of Flame which is the problem.

Any fellow who goes to "interface" with Windows Update should wear a rubber.

I think a lot of the sister sites at Microsoft have the same venereal disease.
Was this answer helpful?

0 comments No comments
Anonymous

2013-11-20T18:12:08+00:00

@Xircal During the Octoberfest with the CPU spiking at Windows Update I observed a peculiar virus like behavior about the svchost.exe when it would be manually terminated from task manager the terminated process would be replaced automatically by TWO instances of the same process, as if in death the process became reappearing "clones" of itself ......which is bizarre behavior. It reminded me of a similar thing that can happen with a browser hijacking of Internet Explorer on the page that can't be closed and reopens 2 copies of itself any time somebody tries to close that browser. It was the exact same effect. So I actually thought at first that this was a virus because of the bizarre self cloning behavior. I saw this with my own eyes and ran the scanner in Microsoft Security Essentials as well as AVG. Security Essentials did tag and remove something but I thought it was a false alarm because this was on a fresh install which had not been used for any web browsing and was not connected to any local network nor exposed to any route by which a virus could be gotten......unless the Windows Update site itself has been infected by a virus. That is what I am thinking has occurred or else there is a script error at Windows Update which has behavior that mimics a virus.

Hi Keith,

Before I forget, the Windows Update site was compromised once which is a nightmare scenario if ever there was one.

The culprit was Flame which managed to exploit a flaw in IE at the time to infect systems via Windows Update.

Maybe the same thing is happening again?

Full story here: Windows Update compromised
Was this answer helpful?

0 comments No comments
Anonymous

2013-11-20T17:53:52+00:00

Thanks for the link. No I was just watching things from task manager which I keep as a tray icon and I have a system manager called TuneUp that will tell me what is loading excessively the CPU and can and will automatically kill the process before it crashes the system unless it is listed as an exception.
Was this answer helpful?

0 comments No comments
Anonymous

2013-11-20T17:44:50+00:00

@Xircal During the Octoberfest with the CPU spiking at Windows Update I observed a peculiar virus like behavior about the svchost.exe when it would be manually terminated from task manager the terminated process would be replaced automatically by TWO instances of the same process, as if in death the process became reappearing "clones" of itself ......which is bizarre behavior. It reminded me of a similar thing that can happen with a browser hijacking of Internet Explorer on the page that can't be closed and reopens 2 copies of itself any time somebody tries to close that browser. It was the exact same effect. So I actually thought at first that this was a virus because of the bizarre self cloning behavior. I saw this with my own eyes and ran the scanner in Microsoft Security Essentials as well as AVG. Security Essentials did tag and remove something but I thought it was a false alarm because this was on a fresh install which had not been used for any web browsing and was not connected to any local network nor exposed to any route by which a virus could be gotten......unless the Windows Update site itself has been infected by a virus. That is what I am thinking has occurred or else there is a script error at Windows Update which has behavior that mimics a virus.

Hi Keith,

I keep an open mind on the subject since I've been surprised on a few occasions in the past.

Do you have Process Monitor? This differs from Process Explorer in that it maintains a record of processes which have been terminated as well as those which are ongoing. That's the problem these days and although Process Explorer is still a good tool, malware can be configured to remove itself from a process before you've had a chance to launch PE.

Might be worth a look if you suspect virus activity.
Was this answer helpful?

0 comments No comments