Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

svchost & Microsoft Updates

1 view
Skip to first unread message

Anthony

unread,
May 14, 2007, 12:55:00 PM5/14/07
to
I am having a very weird issue with Microsoft Updates and a rogue svchost
process on my laptop. When I boot up the laptop, the processor utilization
reaches 100% immediately and continues to stay peeked at 100% unless I kill
it from the task manager. The svchost process will come back in full force
after I kill it if I try to run a Microsoft update, so I believe it is an
issue with the updates service.

I am not getting any error messages, just horrible pc performance. Once in
a while I will get this error from the MS Update website: The website has
encountered a problem and cannot display the page you are trying to view.

I know I can just reimage the PC, but don't want to go there unless I have
to. So far I have,

1. Run complete virus, adware, and spyware scans from regular mode and safe
mode. Found none. Also ran a Macafee and Norton web scan just to be sure.
Also found nothing.
2. Gone to the MS updates website and installed a few hotfixes which had to
do with MS update and processor utiliization which have done nothing.
3. Manually updated the PC via the MS update website.
4. Turned off updates, rebooted, manually updated via the website,
rebooted, re-enabled auto updates.

Does anyone have any additonal advice to help me fix the issue besides
reimaging the PC?

Anthony

unread,
May 14, 2007, 12:58:01 PM5/14/07
to
sorry....the code is actually 0x8DDD009

PA Bear

unread,
May 14, 2007, 1:01:56 PM5/14/07
to
Courtesy of MVP Emeritus Ottmar Freudenberger:

First, install this fix: http://support.microsoft.com/kb/927891

Now install the newly released 'standalone' version of Windows Update Agent
3.0, v7.0.6000.374, for 32 bit machines (*not* Vista or any x64 version of
Windows!):
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

The MS update team believes that this solves all three svchost problems that
folks have been experiencing. See
http://blogs.technet.com/wsus/archive/2007/04/28/update-on.aspx

Also see
http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1071
(First try the steps posted May 4th at the beginning of the article.)

Workaround: Change the default from Microsoft Update to Windows Update: Go
to Microsoft Update > Click on Change Settings in left pane > Scroll to
bottom of page > To Stop Using Microsoft Update > Disable Microsoft Update
software and let me use Windows Update only (check). cf.
http://support.microsoft.com/kb/901037

With Windows Update as your default, you will need to check in at Office
Update to keep your Office applications fully patched:
http://office.microsoft.com/en-us/downloads/maincatalog.aspx

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

AlanB

unread,
May 15, 2007, 10:54:01 AM5/15/07
to
I experienced this problem recently on a computer that had been running
Windows Update and that I adjusted to run Microsoft Update. Although I read
the referneces given by "PA Bear" I'm still not too clear about the context.

Does the problem apply ONLY to computers running Microsoft Update?

Will it manifest rapidly or can computers appear to function normally for a
time before showing problems?

Robin Walker [MVP]

unread,
May 15, 2007, 11:13:42 AM5/15/07
to
AlanB <Al...@discussions.microsoft.com> wrote:

> I experienced this problem recently on a computer that had been
> running Windows Update and that I adjusted to run Microsoft Update.
>

> Does the problem apply ONLY to computers running Microsoft Update?

Yes, but not all PCs running Microsoft Update. It is not yet understood why
a few PCs exhibit this problem when the vast majority are working normally.
I work in an organisation with very many PCs, and have yet to see a single
example of this problem.

It is suspected that the problem is more severe when Office 2003 is
installed. Other versions of Office do not seem to have produced as many
reports of this problem.

Windows Update does not cause this problem.

> Will it manifest rapidly or can computers appear to function normally
> for a time before showing problems?

We don't know. Some PCs were reporting this problem over a year ago. Some
have only just begun to exhibit the problem.

--
Robin Walker [MVP Networking]
rd...@cam.ac.uk


Ottmar Freudenberger

unread,
May 15, 2007, 11:16:45 AM5/15/07
to
"AlanB" <Al...@discussions.microsoft.com> schrieb:

> Does the problem apply ONLY to computers running Microsoft Update?

Yes - and with MS Office (esp. 2003) installed.

> Will it manifest rapidly or can computers appear to function normally for a
> time before showing problems?

The latter.

Bye,
Freudi

Hans-Georg Michna

unread,
May 15, 2007, 4:32:41 PM5/15/07
to
On Tue, 15 May 2007 16:13:42 +0100, Robin Walker [MVP] wrote:

>Yes, but not all PCs running Microsoft Update. It is not yet understood why
>a few PCs exhibit this problem when the vast majority are working normally.
>I work in an organisation with very many PCs, and have yet to see a single
>example of this problem.
>
>It is suspected that the problem is more severe when Office 2003 is
>installed. Other versions of Office do not seem to have produced as many
>reports of this problem.

Robin,

I believe it is slower, single-core processors that experience
the problem, because faster computers get through the process
before the timeout.

Hans-Georg
--
No mail, please.

Hans-Georg Michna

unread,
May 15, 2007, 4:32:41 PM5/15/07
to
On Mon, 14 May 2007 09:58:01 -0700, Anthony wrote:

>sorry....the code is actually 0x8DDD009

Sure?

Mike Meyer

unread,
May 16, 2007, 12:45:50 AM5/16/07
to
Hans-Georg Michna wrote:
> On Mon, 14 May 2007 09:58:01 -0700, Anthony wrote:
>
>> sorry....the code is actually 0x8DDD009
>
> Sure?
>
> Hans-Georg

I think he means 0x8DDD0009. I'm getting the same error.

PA Bear

unread,
May 16, 2007, 12:17:39 PM5/16/07
to
Mike Meyer wrote:
> Hans-Georg Michna wrote:
>> On Mon, 14 May 2007 09:58:01 -0700, Anthony wrote:
>>
>>> sorry....the code is actually 0x8DDD009
>>
>> Sure?
>
> I think he means 0x8DDD0009. I'm getting the same error.

See
http://groups.google.com/group/microsoft.public.windowsupdate/search?q=0x8DDD0009+%2B+mvp&start=0&scoring=d&hl=en

Fix, courtesy of MVP Emeritus Ottmar Freudenberger:

1. First install the newly released 'standalone' version of Windows Update
Agent 3.0, v7.0.6000.374
http://support.microsoft.com/kb/932494

Direct Download links:

x86-based versions of Windows (most users)
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/windowsupdateagent30-x86.exe

x64-based versions of Windows
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/windowsupdateagent30-x64.exe

Itanium-based versions of Windows
http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/windowsupdateagent30-ia64.exe

2. Now (re)install this (updated) fix:
http://support.microsoft.com/kb/927891

3. Reboot.

The MS update team believes that this solves all three svchost problems that
folks have been experiencing. See

http://blogs.technet.com/wsus/archive/2007/05/15/srvhost-msi-issue-follow-up.aspx
and http://blogs.technet.com/wsus/archive/2007/04/28/update-on.aspx

MowGreen [MVP]

unread,
May 16, 2007, 1:33:29 PM5/16/07
to
Hans-Georg Michna wrote:

Not entirely so. There's an issue with the detection scan when it comes
to the DataStore.edb, located in WINDOWS\SoftwareDistribution\DataStore
My theory is that there's been data corruption in said file. I've also
seen said file grow to humongous proportions ... over 1 GB in some
situations.
As to what's caused it ... perhaps scanning or monitoring of the system
with an 'intrusive' AV [EX: Symantec 'products' aimed at Home Users]
and/or update sessions that may have been unexpectedly ended.

I don't think this issue can be tied soley to older, slower processors.
In fact, an ex-MVP contacted me about his brand new Vista system
experiencing this issue. It's far from 'under powered' and Office 2007
is installed.
We cleaned out the SoftwareDistribution subfolders and I suggested that
it not be scanned. The issue has not come back, yet.
Now I wish that I'd suggested deleting the DataStore.edb instead <w>

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

Mike Meyer

unread,
May 16, 2007, 2:52:03 PM5/16/07
to
PA Bear wrote:
> http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/windowsupdateagent30-x86.exe
> http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/windowsupdateagent30-x64.exe
> http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/windowsupdateagent30-ia64.exe
> http://support.microsoft.com/kb/927891

>
> The MS update team believes that this solves all three svchost problems
> that folks have been experiencing. See
> http://blogs.technet.com/wsus/archive/2007/05/15/srvhost-msi-issue-follow-up.aspx
> and http://blogs.technet.com/wsus/archive/2007/04/28/update-on.aspx

Indeed, that fixed my issue.

PA Bear

unread,
May 16, 2007, 4:17:36 PM5/16/07
to

Thanks for the feedback, Mike. Much appreciated!

AlanB

unread,
May 16, 2007, 6:04:02 PM5/16/07
to
How big should the DataStore.edb file be?
Is it sufficient to install the two recommended updates or should you also
reconstitute the DataStore.edb file to play safe?

Robin Walker [MVP]

unread,
May 16, 2007, 6:13:38 PM5/16/07
to
AlanB <Al...@discussions.microsoft.com> wrote:

> How big should the DataStore.edb file be?
> Is it sufficient to install the two recommended updates or should you
> also reconstitute the DataStore.edb file to play safe?

Don't fix what is not broken. Just install the two patches. Then see if
there is still an issue.

The DataStore.edb file seems to be anything up to 40 or 50MB on most
machines I have looked at. The smallest I have seen is around 20MB.

MowGreen [MVP]

unread,
May 17, 2007, 4:32:20 PM5/17/07
to
In regards to my theory about NOT scanning the SoftwareDistribution
subfolders and *especially* DataStore.edb -

Virus scanning recommendations for computers that are running Windows
Server 2003, Windows 2000, or Windows XP
http://support.microsoft.com/kb/822158

> For computers that are running Windows Server 2003, Windows 2000, or Windows XP
>
> Do not scan the following files and folders. These files are not at risk of infection.
> If you scan these files, serious performance problems may occur because of file locking.
>
> Where a specific set of files is identified by name, exclude only those files instead of
> the whole folder. Sometimes, the whole folder must be excluded. Do not exclude any one of
> these based on the file name extension. For example, do not exclude all files that have a
> .dit extension. Microsoft has no control over other files that may use the same extensions
> as the following files.
> • Microsoft Windows Update or Automatic Update related files
> • The Windows Update or Automatic Update database file. This file is located in the
> following folder: %windir%\SoftwareDistribution\Datastore
>
> Exclude the Datastore.edb file.
>
> • The transaction log files. These files are located in the following folder:
> %windir%\SoftwareDistribution\Datastore\Logs
> Exclude the following files:
> • Edb*.log
>
> Note The wildcard character indicates that there may be several files.
> • Res1.log
> • Res2.log
> • Edb.chk
> • Tmp.edb


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

0 new messages