Serious Problem

[Noob88]

Ok, I started my copmuter up today when I got home from school, and it started up normally. Then, once it was completely on, I tried to open the internet and it took a good 45 seconds for me to display the home page compared the the 2 seconds it normally takes. I attempted to open my task manager and it took a couple minutes for that to show up. When I went to processes, I noticed that svchost.exe under User Name SYSTEM was using memory of about 200,000K, with a CPU usage varying from 30-100, mostly staying in the 90s. I have no idea what's wrong with my computer, every time I tried running any kind of program, it took so long it froze my computer up and I had to restart. Needless to say, I restarted my computer a good 20 times in the past hour trying to figure out what was wrong. Anyone have any idea?

[Arcane Wizard]

Buggy service or malware pretending to be svchost.

Try process explorer to see what process under svchost is messing up.

Boot into safe mode and download it if you don't have it yet.

[Noob88]

Could you explain to me what exactly I should do? I don't know much about this kind of stuff with computer maintenance and what not. :|


[EDIT] to try to maintain some functionality of my comp, I did End Process on the svchost.exe that was causing the problems, now my sounds is disabled for teamspeak and everything on my computer... Someone please help me fix this :(


[EDIT 2] Anyone who has AIM or xfire and can help me on that, it would be easier and much appreciated.

AIM: Trainboy888
xfire: crazyplaya88

Thanks

[Arcane Wizard]

Windows sound is a service running under svchost which hosts a whole bunch of windows services.

If you download processexplorer from Microsoft you can tell exactly which of these subprocesses is causing the problems. Here: http://www.microsoft.com/technet/sysintern...ssExplorer.mspx

Once you know which it is, you can end only that specific subprocess and determine if it should be fixed or removed from your system altogether (in case of virus/spyware/whathaveyou).

In other words:

• Download process explorer.
  
• Run it.
  
• See which subprocess of svchost is the problem.
  
• Post here which it is and what happens when you end it.
  

[Noob88]

It is the svhost with a plus sign next to it, and when I click the plus sign to see what's under it, it ways wuauclt.exe, Description: Automatic updates. I ended that process to see what would happen, and basically nothing, the svchost.exe process still stayed in the 90-100% range. So I went to properties to look for a specific problem THREAD, and found this at about 95%:

ntdll.dll!RtlAllocateHeap+0x18c

When I kill this process, my computer goes back to functioning normally, until I restart it, at which point I'm back to square 1. Any ideas?

[benryves]

I had an identical problem a few months ago, after updating a fresh SP2 install via Windows Update. The update didn't break any of the other (at that point) up to date machines, just that one.

The solution was to simply restart in safe mode, use System Restore to go back to before the dodgy update, disable automatic updates, then switch them back on and run a manual update a couple of weeks later.

[Arcane Wizard]

I'm guessing tuesday's update has messed up.

See if you can run windows update again, might fix things.

You'll probably have to wait for a hotfix from Microsoft and untill then disable the update service. Something I recommend you do anyway.

THere may already be a specific fix but I can't look for it right now.

[Noob88]

Where exactly do I go to disable the automatic updates service?

[benryves]

Control Panel, Automatic Updates, Turn off Automatic Updates.

[Noob88]

I disabled the automatic updates and the problem disappeared.... for now anyway. Is there any way to get the red box from popping up on startup and staying there telling me my computer may be at risk because updates are off?

[benryves]

Control Panel, Security Centre, Change the way Security Centre alerts me ("Resources" pane), untick Automatic Updates.

Edit: Alters? Alerts.

[Noob88]

Thanks a lot everyone

[NETWizz]

Hi, we have seen this problem a lot at work recently. In fact, I have delt with deploying the patches to over 1000 systems exhibiting this bug.

Our problem stems from an error with WSUS (Windows Software Update Services), which also uses the Automatic Update Services as directed and defined in the Applied Group Policy Objects (GPO).

The situation is that SVCHOST hangs at 99% causing the system to become unresponsive and hung. It will hang a system for about 10 to 45 minutes depending on its speed and how many times it tries to connect to the update service.

The two affected components are:
Automatic Update Service
Widnows Installer Service

To fix the problem, you need multiple patches.

1. First, stop the "Automatic Updates" Service.

Start > Run > Services.msc

Find "Automatic Updates" and Stop it. DO NOT DISABLE IT! Stopping it will cause SVCHOST to start behaving properly and release your CPU. Your system will become responsive.

Now, you need to first install the Windows Update Agent 3.0, which will not require a reboot.

2. Install the "Automatic Updates" Patch

http://download.windowsupdate.com/v7/windo...Agent30-x86.exe

No Need to Reboot

3. Install the Windows Installer (MSI) Patch.
Update for Windows XP (KB927891)

http://www.microsoft.com/downloads/details...&displaylang=en

NOW REBOOT This will happen unless you check the box telling it not to reboot.

The system should startup in a fully responsive state with all of its services working properly including the Windows Installer and Automatic Updates.

_______

If the system hangs solid, please try Safe Mode.

Tap F8 to enter safe-mode

From Safe-mode, run Services.msc and DISABLE "Automatic Updates," so it will not start in Normal Mode. Now, Restart in Normal mode.

Install the same Aformentioned Patches with one Caveat.

Before restarting after installing the MSI Windows Installer Patch, change "Automatic Updates" back to "Automatic," so it will startup.

The system should startup and be responsive regardless of what means you used to isntall the aformentioned patches.

-------

If you later recieve a Shared Access Violation during Windows Update, Thank Microsoft again. Be sure to drop the Microsoft Fariy a Line. Then read this and consider installing this patch.

http://support.microsoft.com/kb/927891/


What is most annoying is that every system is different. At work, we have multiple machines running exactly teh same hardware and bios firmware. They are imaged with the exact same Windows Drive Image, yet some have this issue and some do not. The patches typically work on most systems, but they are not perfect in that they do not appear to fix all computers.

It should give you a great deal of confidence in Microsoft that they have a patch called WindowsXP-KB927891-v3-x86-ENU.exe

I guess it took them 3 tries to patch that problem :biggrin:

Until Next Time...

//NETWiz