The WinXP Windows Update CPU saturation bug

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

mikeymikec

Lifer
May 19, 2011
20,992
16,236
136
Yeah, there seems to be a "2nd wave" of the bug: http://www.infoworld.com/t/microsof...svchost-redlined-100-fix-it-kb-2879017-230733

I turned off Automatic Updates, then installed KB2879017 and KB2888505 manually, then the updates started working again for me.

I just had another bash at this problem. Fresh WinXP Pro SP3 install, ran WU, saw the bug straight away (no updates installed yet, occurred during first WU check).

I downloaded and ran IE8 without updates during the install, then installed the two patches you mentioned, rebooted, then WU successfully installed the first patch without problems, then about 126 updates without problems, then while the "Windows Genuine Advantage installer" was running, "running processes after install", the bug happened again (>5 minutes of CPU saturation). I terminated the saturating svchost.exe, but the installer wouldn't budge so I told Windows to restart. Upon reboot, the WGA installer came up again, and svchost.exe started going nuts again. I'll try leaving it for longer this time.

- edit - after 10 minutes of CPU time, the WGA installer finally completed and svchost calmed down.
 
Last edited:

Mushkins

Golden Member
Feb 11, 2013
1,631
0
0
I've been reloading old XP machines to donate to a charity lately, and this has been killing me. Installing IE8 manually before running windows update usually avoids the issue, but sometimes you've just gotta let it sit :/
 

VirtualLarry

No Lifer
Aug 25, 2001
56,587
10,225
126
I've been reloading old XP machines to donate to a charity lately, and this has been killing me. Installing IE8 manually before running windows update usually avoids the issue, but sometimes you've just gotta let it sit :/

Yeah. I just did an XP Pro SP3-integrated install last night, and I couldn't even do WU, it was throwing some sort of obscure error message. (Nevermind the 100% CPU usage.)

So it seems, in order to use WU on XP SP3, you have to first install IE8, and then Update Agent 3.0 for XP.

Even then, when I finally was able to do Windows Updates, it did hang for like 30 minutes, with one CPU core basically locked up solid. Finally, it was able to determine that Windows Update had to be updated. Once that was done, it detected, downloaded, and installed, 125 Updates without issue.

I guess you do just have to let it sit for a while.

Thankfully, this machine is a dual-core, so WU was only chewing up one core, leaving the other core for me to use while it was busy.
 

corkyg

Elite Member | Peripherals
Super Moderator
Mar 4, 2000
27,370
240
106
Have gotten all automatic updates since SP3 and have never seen such a bug. As for my old XP machines (2) - they will fade away. there are 3 Win 7 and 2 Win 8.1's present for duty. Attrition will solve things.

What is this bug suposed to do?
 

Matt1970

Lifer
Mar 19, 2007
12,320
3
0
Have gotten all automatic updates since SP3 and have never seen such a bug. As for my old XP machines (2) - they will fade away. there are 3 Win 7 and 2 Win 8.1's present for duty. Attrition will solve things.

What is this bug suposed to do?

It ties up your processor rendering your PC unusable.
 

corkyg

Elite Member | Peripherals
Super Moderator
Mar 4, 2000
27,370
240
106
OK - is that temporary or permanent until rebooted?
 

corkyg

Elite Member | Peripherals
Super Moderator
Mar 4, 2000
27,370
240
106
Will XP Pro/SP3 do a direct upgrade to Linux including all hardware and peripherals? If not, the problem is far from solved. It will be solved with a new machine. :)
 

Matt1970

Lifer
Mar 19, 2007
12,320
3
0
Rebooting works until it checks for updates. You can keep ending the svchost.exe process in task manager but that as well only works until it checks for updates again. I know almost every time I have run the supposed fixes for the problem they do not work. The only thing that has worked for me is disabling updates all together. There probably won't be any real updates for XP anyways except for some lame hole patching in the .net framework.
 

mikeymikec

Lifer
May 19, 2011
20,992
16,236
136
Based on a suggestion which was similar to suggestions I've previously come across:

http://forums.anandtech.com/showthread.php?p=35827839#post35827839

Here is a log of my latest attempt to fix this problem (which hasn't been successful):

tested for cpu saturation bug positive, stopped and disabled AU
downloaded and installed KB2888505, rebooted, re-enabled AU and wuauclt /detectnow
tested for cpu saturation bug positive, stopped and disabled AU

stack for wuaueng.dll (thread of the svchost.exe with 100% CPU usage) running during saturation:
ntkrnlpa.exe
hal.dll
ntdll.dll
wuaueng.dll (100%)
kernel32.dll

suspending the thread results in cpu usage drop, resuming it resumes saturation
stopped and disabled AU

downloaded netfx20sp1_x86.exe, dotnetfx30sp1_x86.exe, dotnetfx35setup.exe, dotnetfx40_clientx86_x64.exe

running installers one after the other unless I'm told to restart
surprising that it didn't act as if I had any of these installed (perhaps I didn't)
restarting because 3.5 asked me to

installing 4.0, noticed ngen command with command switch is run during setup
rebooted when asked to after install


C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319>ngen executequeditems
Microsoft (R) CLR Native Image Generator - Version 4.0.30319.1
Copyright (c) Microsoft Corporation. All rights reserved.
Installing assembly executequeditems
Uninstalling assembly executequeditems because of an error during compilation: The system cannot fin
d the file specified. (Exception from HRESULT: 0x80070002).
The system cannot find the file specified. (Exception from HRESULT: 0x80070002)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>ngen executequeditems
Microsoft (R) CLR Native Image Generator - Version 2.0.50727.3053
Copyright (c) Microsoft Corporation. All rights reserved.
Installing assembly executequeditems
Failed to find dependencies of image executequeditems because of the following error: The system can
not find the file specified. (Exception from HRESULT: 0x80070002)
Compiling assembly executequeditems ...
Error compiling executequeditems: The system cannot find the file specified. (Exception from HRESULT
: 0x80070002)
Uninstalling assembly executequeditems because of an error during compilation.
The system cannot find the file specified. (Exception from HRESULT: 0x80070002)

re-enabled AU, wuauclt /detectnow
tested for cpu saturation bug positive, stopped and disabled AU
removed all .net frameworks, based on my theory that .net has nothing to do with this problem.

re-enabled AU, wuauclt /detectnow
tested for cpu saturation bug positive, stopped and disabled AU

re-enabled AU, wuauclt /detectnow
tested for cpu saturation bug positive, stopped and disabled AU

time test, how long does svchost.exe take on a 3GHz single core VM to complete
test started at 14:51

side note: In windowsupdate.log, the last entry (while running time test) so far is:
Code:
2013-12-11    14:51:32:250    1016    540    PT    +++++++++++  PT: Synchronizing extended update info  +++++++++++
2013-12-11    14:51:32:250    1016    540    PT      + ServiceId = {9482F4B4-E343-43B6-B170-9A65BC822C77}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx
I've seen this entry before during the saturation phase, while it is quite common, it's not the only message I've seen during this phase.

Other observations:
Nothing else going on in process explorer except for the saturating process
No disk activity (looking at the VM software's disk activity indicator)
No network activity (looking at both the XP network systray icon and the VM software's network activity indicator)

Observations from previous occasions:
Process Monitor doesn't show any potentially interesting activity during the saturation phase, just the normal crap that goes by like lsass looking in the SECURITY key and the other one that likes to check out TCP/IP linkage all the time.

saturation stopped at 15:19

installing 11 updates (including an IE cumulative)
reboot when requested
wuauclt /detectnow
cpu saturation bug not observed this time (but I suspect this is the behaviour seen by many where the bug appears to be fixed by a particular update... 'until next time').

-----

IMO this isn't going to be fixed by a cumulative IE update, it doesn't make any sense, IMO. My reasoning is that if the Windows Update system required something from IE, then surely all the fixes for the Windows Update Agent would include something to prod/reset IE. Same goes for the .net framework, though I think I've pretty conclusively proven that the .net frameworks don't have anything to do with this.

The only other components I can think of that could potentially be involved is MSXML and WMI. However, I think these are unlikely for the same reason as I stated for IE. The only reason I'm considering MSXML is because this bug seems like a processing issue. The processing does complete otherwise I wouldn't have been notified of any Windows Updates, so a process isn't locking. There's next-to-zero disk activity, so it seems logical to me that whatever is being processed is in memory already, and wuaueng.dll is chewing over that data (very inefficiently?). I don't know whether XML has any role to play in the storage mechanism for the Windows Update system, but as MS has had a bit of a hard-on for XML for a while, I think it's a reasonable guess.

I know it's not a Windows Update database issue because clearing out the SoftwareDistribution folder makes no difference.

The only way I can tentatively link IE to this situation is that Windows Update was originally an IE only app. Perhaps something that IE uses as well as Windows Update is needed, like say the XMLHTTPRequest API. How often does it get updated? Perhaps not often, but perhaps recently?
 
Last edited:

VirtualLarry

No Lifer
Aug 25, 2001
56,587
10,225
126
face the facts, the bug is intentional

Edit: here's my thinking on this. The bug has existed in the wild for at least six months. It's not an obscure, hard-to-find bug either, since it seems to happen to nearly everyone these days doing a fresh install of XP SP3.

So why hasn't MS assigned some dedicated debugging engineers to fix the problem?

Either you accept the premise that MS is literally incapable of debugging their own OS (and if so, how do they manage to release security patches monthly?), or you have to accept that the bug is intentional, and MS has no desire or intent to fix it.
 
Last edited:

mikeymikec

Lifer
May 19, 2011
20,992
16,236
136
So why hasn't MS assigned some dedicated debugging engineers to fix the problem?

Priorities? Fix a bug in an OS you're retiring shortly, or get on with more active projects?

I'm not saying that this is a morally reasonable way of looking at it.
 

TerryMathews

Lifer
Oct 9, 1999
11,464
2
0
Priorities? Fix a bug in an OS you're retiring shortly, or get on with more active projects?

I'm not saying that this is a morally reasonable way of looking at it.

Its more akain to your mechanic replacing the water pump he broke while you were in for an oil change.

Windows XP used to not have an issue running Windows Update. Intentionally or not, Microsoft has done something that has broken it.

They should be obligated to fix it.
 

Mushkins

Golden Member
Feb 11, 2013
1,631
0
0
Its more akain to your mechanic replacing the water pump he broke while you were in for an oil change.

Windows XP used to not have an issue running Windows Update. Intentionally or not, Microsoft has done something that has broken it.

They should be obligated to fix it.

They're not going to push resources to fixing a bug in a decade old OS thats end of support in literally 4 months. This bug doesn't even affect the majority of people still using a supported version of XP: businesses. Anyone in an XP environment these days is pretty much using a disk image with enough baked-in updates to avoid the bug, using WSUS, or both.

It's not worth the time or the money to fix it at this point.
 

TerryMathews

Lifer
Oct 9, 1999
11,464
2
0
They're not going to push resources to fixing a bug in a decade old OS thats end of support in literally 4 months. This bug doesn't even affect the majority of people still using a supported version of XP: businesses. Anyone in an XP environment these days is pretty much using a disk image with enough baked-in updates to avoid the bug, using WSUS, or both.

It's not worth the time or the money to fix it at this point.

Are you OK with Microsoft sabotaging a product they want you to move off of?
 

corkyg

Elite Member | Peripherals
Super Moderator
Mar 4, 2000
27,370
240
106
Got an auto update to XP yesterday - there were 11 files involved. Still nothing abnormal. System runs as usual. Files were:

1 for Office 2003
2 for Office 2007
1 for IE8
1 for MSE
5 for XP Pro w/SP3
 
Last edited:

nemesismk2

Diamond Member
Sep 29, 2001
4,810
5
76
www.ultimatehardware.net
Got an auto update to XP yesterday - there were 11 files involved. Still nothing abnormal. System runs as usual. Files were:

1 for Office 2003
2 for Office 2007
1 for IE8
1 for MSE
5 for XP Pro w/SP3

My copy of Windows XP Pro SP3 managed to update itself ok yesterday. All the same as you apart from the Office ones because i don't have Office. I also installed 3 optional ones as well.
 

TerryMathews

Lifer
Oct 9, 1999
11,464
2
0
My copy of Windows XP Pro SP3 managed to update itself ok yesterday. All the same as you apart from the Office ones because i don't have Office. I also installed 3 optional ones as well.

Was your install a fresh one?

The bug happens on new installs.
 

corkyg

Elite Member | Peripherals
Super Moderator
Mar 4, 2000
27,370
240
106
Was your install a fresh one? The bug happens on new installs.

Interesting point. Never heard that one before. That might explain why my XP Pro has not been affected. I have never done a clean install.
 

mikeymikec

Lifer
May 19, 2011
20,992
16,236
136
Interesting point. Never heard that one before. That might explain why my XP Pro has not been affected. I have never done a clean install.

I've seen it on older installs as well though.

I'm not sure I've seen the problem on XP Pro, not that it should make any difference...