SVCHOST problem is back

[liliggyracin]

Ok we have 400 plus computers mostly running XP PRO SP2 pushing updates through wsus server All systems have office 2003 with the exception of a couple office 2007 machines. Running the two part fix for the svchost problem does not work. Problem is so severe that it is affecting the buisness and the amount of work that people can actually do. Has anyone tried anything else to fix this problem. We do not leave our pcs on all the time at the current so setting up to automatically download and install during the off hours will not work. And of course it does not affect any set group or type of computer it picks and chooses who it wants to mess with and today it just had to be people in our administration who dont understand why we cant get the problem taken care of. Any and all help would be appreciated.

DC and DNS servers are all 2003 servers. If I am leaving anything out please let me know and I will get you the info.

Thanks in advance.

[GomJabbar]

I understand you have a problem with SVCHOST, but what exactly is your problem? What are your computers doing or not doing?

[liliggyracin]

Problem is that the svchost using 99 percent of system resources again so much that using other programs is not possible Its the same SVChost that has a sticky somewhere around here but the two step fix didnt work for us.

[GomJabbar]

Here are some Microsoft Knowledgebase articles that may help.

http://support.microsoft.com/kb/932494/en-us

http://support.microsoft.com/kb/916089/en-us

http://support.microsoft.com/kb/303777/en-us

http://support.microsoft.com/kb/892489/en-us

http://support.microsoft.com/kb/927891/en-us

http://support.microsoft.com/kb/903737/en-us

http://support.microsoft.com/kb/914962/en-us

I don't have time to look more now.

[jdhurst]

I don't have a problem with svchost and my computer is loaded with stuff, and in addtion, was built from the preload. I am using Office 2003 Professional. I also have every possible Microsoft update loaded (even the recommended stuff) and I have the newest IBM drivers on my ThinkPad and on my IBM Desktop.

Also, it seems unlikely to be a user problem given your statement that svchost is affecting 400 computers.

So can you think of something you might have loaded in your image that would cause this? There may be an interaction somewhere that we don't have. ... JDH

Note: It just occurred to me that Windows Auto Update can cause this, and I don't use Auto Update except to have it inform me that updates are available.

[liliggyracin]

I don't have a problem with svchost and my computer is loaded with stuff, and in addtion, was built from the preload. I am using Office 2003 Professional. I also have every possible Microsoft update loaded (even the recommended stuff) and I have the newest IBM drivers on my ThinkPad and on my IBM Desktop.

Also, it seems unlikely to be a user problem given your statement that svchost is affecting 400 computers.

So can you think of something you might have loaded in your image that would cause this? There may be an interaction somewhere that we don't have. ... JDH

Note: It just occurred to me that Windows Auto Update can cause this, and I don't use Auto Update except to have it inform me that updates are available.

I do know that there was a kb article stating that this was a known issue with people running
1. Office 2003
2. Windows XP
3. WSUS server

The fix was a 2 part fix running manually
1. KB927891
2.Windows Update 3.0

We are supposed to only run this on the machines affected so I have been but it has not helped at all. Yesterday I pushed 2 updates from the WSUS server and had almost 80 phone calls of their system not responding and countless others noticing significant performance loss. I am currently going through the links posted by GomJabbar to see if there is something that I have over looked.

[K0LO]

I do know that there was a kb article stating that this was a known issue with people running
1. Office 2003
2. Windows XP
3. WSUS server

This problem also affected people who were NOT updating via a WSUS server. In my family, only one of our PCs was affected and the rest were fine. After Microsoft released the two final "fixes" via Windows Update the problem went away on the affected PC. Until then I discovered a temporary workaround by accident. I disabled Microsoft Update on the affected machine and went back to using plain old Windows Update and this stopped the 100% CPU problem and made the machine usable again.

I'll have to plead ignorance of how WSUS servers work, but for a standalone machine, disabling Microsoft Update so that the Office files were not scanned did fix the problem.

[Temetka]

Shoot and I was just about to talk about WSUS servers.

If the OP has an environment that large, should IT/MIS be testing updates in a controlled situation before applying them en-masse?

I ask because nearly every large corporation that I consult for has policies regarding nearly every aspect of the workstations and servers. Every single one of them has a policy regarding application and OS patches / updates.

[liliggyracin]

Yes we do test the updates and we choose which ones we want to deploy and do not want to deploy. The problem is Just because the update went smooth on our "test machines" Doesnt mean that it wont cause havoc with other users. Microsoft just needs to get off their butt and fix the problem once and for all but since I dont really think they know what is causing it completely besides a severe memory leak I see no permanent action coming anytime soon.

[Temetka]

Trust me I understand that tests can say one thing and reality says another.

To be honest I think Microsoft has switched a lot of it's programming resources to fixing Vista, updating the Server Line, launching Home Server and getting ready for the next version of Windows.

XP is so old I do not think that they maintain more than a token amount of programmers and bug testers for XP development. They may transfer more people back over for SP3.

[liliggyracin]

Well I Recieved another hotfix from Microsoft via email today in reference to Kb939273 and tried to load it on a machine that I know has the problem. However once I tried to load it I got a message I was on the wrong version of Windows. So I called MS and said wth. The tech then told me that I must have MEdia edition or Tablet edition for that particular update to work. So I proceeded to drill them and ask for questions and possible resolutions none to my liking. Their response was that I would possibly need to upgrade all of my systems to run Vista..... Not going to happen anytime soon. I was not thrilled with the answer and am currently on hold for a different person to see what I can get accomplished. I figure if nothing else maybe I will get some self satisfaction from pestering the heck out of them

[Temetka]

Sounds like fun...

[liliggyracin]

Sounds like fun...

Lol well for the first however long its been 15-20 minutes I guess I spent arguing with some lady who wanted 245 dollars for me to speak with a tech because what I outlined to her did not sound like a bug untill I Started rattling off KB articles and she was like oh well please hold... Now for the last few 3-5 minutes I would say I am on hold. lol Will keep you updated on this call!!!

[liliggyracin]

well the call didnt go as well as I would have liked. Their answer was to remove all updates on the machines. Reboot and let windows put the updates back on.. Grrrrr Well anyway. I decided to just say the hell with it and hung up. Idiots Lets pay someone 15c an hour and see if we can get them to piss people off enough to go to linux. Well they almost have succeeded

[jdhurst]

As I noted earlier, I have ALL updates loaded (manually, via Windows Update on the Internet).

So as I read through this, is there any chance WSUS is doing this to you? Removing all the updates on 400 machines and reloading is a big pile of work.

What would happen if you turned off Auto Update and WSUS for a while?
... JDH

[liliggyracin]

As I noted earlier, I have ALL updates loaded (manually, via Windows Update on the Internet).

So as I read through this, is there any chance WSUS is doing this to you? Removing all the updates on 400 machines and reloading is a big pile of work.

What would happen if you turned off Auto Update and WSUS for a while?
... JDH

I have tried turning off WSUS and pulling Auto updates directly from MS and I still have the same problem. I also try running just by going to Update on the web and still have the same problem with it taking forever to run. Not sure what I am going to do.

[jdhurst]

You have a lot of computers, so you must have a spare.

Plan B:

1. Take a spare computer, image it fresh, turn off Auto Update altogether, update to SP2 and ALL patches (but not special knowledge base patches that do not come up with Windows Update), and test for slowness.

2. Now add in all your applications, and test for slowness.

3. Now personalize and give to a user and check for slowness.

If the machine above is slow, then it must be one of your applications. If it is now slow, then either some of the Knowledge Base additional patches or WSUS / Auto Update is apparently at fault.

... JDH

[liliggyracin]

You have a lot of computers, so you must have a spare.

Plan B:

1. Take a spare computer, image it fresh, turn off Auto Update altogether, update to SP2 and ALL patches (but not special knowledge base patches that do not come up with Windows Update), and test for slowness.

2. Now add in all your applications, and test for slowness.

3. Now personalize and give to a user and check for slowness.

If the machine above is slow, then it must be one of your applications. If it is now slow, then either some of the Knowledge Base additional patches or WSUS / Auto Update is apparently at fault.

... JDH

Well I think I may have found a way to correct this issue no help from microsoft though. I copied the msi.dll file off a computer that I know was working good. I then Unregistered the msi.dll file off the computer acting up and deleted it. Then I copied the new msi.dll file over and registered it. I ran auto updates and boom flew right through. Granted this was just on one machine but I can always hope that this will work for the rest because I will just create a .msi file for it and send it out via GPO for the trouble makers. Will keep you posted and let you know.