Microsoft still trying to fix SVCHOST bug in Windows XP

Topic

New Reply

http://www.neowin.net/news/microsoft-still-trying-to-fix-svchost-bug-in-windows-xp

Jerry

Reply | Quote

Replies

The bug seems to relate to SVHOST *and* WUA (Windows Update).
I don’t know, when no more XP support, I would turn off WUA completely.

Reply | Quote

i have a different svchost problem
read somewhere it related to norton antivirus

when shutting down, the system stops doing the shutdown
until it automatically kills svchost separately which takes a couple of minutes

Reply | Quote

i have a different svchost problem
read somewhere it related to norton antivirus

There’s very definitely one with MSE (Microsoft Security Essentials) and XP. I just encountered it on an ancient system, startup and runtime is pegged by a svchost execution. When MSE goes away, that issue goes away so they are directly related but I don’t know if there’s another solution other than uninstalling MSE.

Reply | Quote

@Bronze Lounger
MIght not have to uninstall it, just shut it down manually beforehand. Should work. Shutdown network connection first, of course. [grin] If must needs, one could kill that particular svchost instance (either the updated taskmanager or a replacement will show what’s using what). Ghargh – old systems and new stuff, always fun.

Reply | Quote

Svchost bug? what bug? I’ve never seen one.

Is anyone still using Norton anything? No-one I know!!!

Doesn’t everyone today, use a Quick Shutdown shortcut on their desktop or in their Taskbar???

In 2013, I’m surprised that we’re still discussing these things, that should have been settled ages ago.

Oh by the way, the Quick Shutdown ‘shortcut’ (for XP only) goes like this:

%windir%System32shutdown.exe -s -t 00 -f

Just copy and paste that line into a new Desktop shortcut and you’ve got it!

I’ve been using this shortcut for about a decade, give or take a year or two, and my PC always shuts down in 5-8 sec’s.
Just a suggestion……

The Doctor

PS: Is anyone going to see my new movie?

Reply | Quote

More issue than bug, most of it. From years back there are some good kb articles on various aspects of and situations found with service_host. There was a lot of stuff that could be dug out of MSDN last time I looked, a long time back. More recent info can be found at sysinternals, and IIRC Mark Russinovich wrote an article or two on svchost-related problems.

Any prg that hooks OS vectors can be problematic if it is impolite about releasing memory, shutting down child processes, for instance. But you know this.

Norton went through a bad patch. We all know that. What I found in practice is that by ’09 they’d cleaned up their act; the stand-alone AV worked well, played nice, and was easy on resources. Even their suite became quick and polite and also worked well according to av-comparatives. I haven’t looked at their latest, but anyone still carrying the anti-Norton torch might do well to catch up and at least look at what Norton is now doing. (I fear they may be heading to bloat territory again, but as I say, haven’t looked at it in a year or two.)

Thanks for the command – I keep finding and forgetting it through various XP installs. Always nice to see Minix-compliant options. Years back I wrote a .bat to selectively shutdown recalcitrant processes that caused shutdown.exe to hang while waiting for a particular svchost-using app to clear. Got that info from logs, the admin utility, and process explorer. The command you give nicely short-circuits all that and simply forces apps to say goodbye. (It’s a good idea to manually shutdown anything that might have to write out something to disk before using it, btw.)

Yeah, most of this has been settled, but there are still programs being written for XP or old programs finding themselves in an environment different than the programmer had planned on living in. We can easily forget just how idiosycratic one of our installs can get after a few years of arriving at a particular blend of programs and our favorite tweaks. For grins one can run diff against the hives from a pet install to a fresh one.

What I usually did was to shut down any apps or games, then run the script to shutdown network, a handful of services including AV and software firewall, run erunt, and then call shutdown.exe – worked well and quickly, leaving me with a clean system for next power-up.

Svchost – oh, my.

Reply | Quote

Is anyone still using Norton anything? No-one I know!!!

I seem to recall a certain DrWho who swears by Norton Ghost for DOS.

Just sayin’.

Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server

Reply | Quote

Warning – Rant, mostly but some basic info about it

This is unfortunate – happens with some clean installs of XP SP3 after you try to auto update – I personally do not appreciate having to upgrade all my machines and all my friends machines to the latest (actually Win 7 pro, or even Vista SP2, which is quite fine too, leaving Win 8+ for the newbies graduating from surfing on their smartphones) when they do actually work fine otherwise. Security? … bah .. put them behind a solid hardware firewall and when surfing /opening “funny” websites just open these in a sandbox (use sandboxie) … backup your data and system separately, you’re fine. THink using the latest is better? .. same security problems, new updated versions too.

The real way to deal with malware is to treat it as what it is, a crime. No one gets away from shooting people in the street, or not paying their taxes .. so why is it so difficult to police the internet? Seriously ..think about it for a moment.
Wouldn’t there be a better use of all this mind power – instead of fixing patches etc.

Back to Svchost … there are a few ways around it .. sometimes downgrading the priority to below normal lets enough cpus through so the relevant update gets applied and after that all is smooth sailing .. other times the Fixit does it . .other times wiping out the cache of downloaded updates does it .. Usually simplest if you can apply the updates manually, and use recent images of your clean system .. yeah it’s messy. True, Microsoft makes it easier with Win 7, fewer glitches – but a humongous WinXSX or something folder which grows to huge GB just for the sake of smooth user experience. If you try some software and uninstall it (even very thoroughly), Win 7 keeps a record and grows is Win SXS folder …

And about the Norton/ Symantec bashers .. it’s complicated – for a while Norton (for consumer products) was a hog with a lot of issues … while Symantec for corporations was much better .. now not bad at all .. together with Sophos it’s the only one which detected a known piece of malware in my systems ( none of MS free A/v, Avira, Avast, Superantispyware, or Malwarebytes caught them … ).

Final words of wisdom, it’s a nice morning and I feel the need to pay back all the good folks who’ve contributed useful tech nuggets over the years.
With the price of machines falling down to ridiculous prices, much better to SEPARATE the use of computers: one for serious work (no browsing funny/ entertainment sites, of Fecesbook – I hope you all resisted the temptation to give them access to all your password info re easy log ins – hint: use a password manager like LastPass, free to boot ), one for entertainment (which you can easily wipe clean, as you will have saved all important info in the cloud or local backup media)

Reply | Quote

Hi All:

FWIW: I migrated all my users to Win7-64-bit, except for one “research” box still running XP. I also have one client loaner laptop with WinXP (because their “tech support” person didn’t know how to set up XPMode under Win7-64-bit to allow a required legacy Win-16-bit program to still work). I have also kept one virtual machine with WinXP on it “just in case” I needed to debug something else.

Well, after trying to follow Micro$$oft directions to “compact” the XPMode setup and it destroyed itself instead, I decided to bite the bullet and try setting up a Win7-32-bit in a VM (VirtualBox) on my Win7-64-bit system, and was able to run every legacy WinXP capable application I’ve tried (so far), and none of the bulls*t with svchost that has started (again) on all the other WinXP setups, even after the “FixIt” and other attempts. So, although I am keeping the VirtualBox WinXP setup, I am moving all my other testing of legacy software to the Win7-32-bit VM. Easy to have multiple OSes, as I still have my TechNet subscription…

Just as an aside: I have to “wonder” if Micro$$oft is failing to FIX the svchost problem that suddenly came back again as an additional means to force customers off of WinXP… Just a thought…:rolleyes:

So, even though I agree heartily with everyone that 64-bit is the way to go moving forward, anyone with a need for legacy software that runs under WinXP might want to consider using Win7-32-bit at least for the short term. With the “end-of-support” for WinXP coming up in April 2014, its something to look into…

Hope that helps someone. Happy Thanxgiving to all!

Rob

Reply | Quote

My wife’s laptop had this issue starting 60 days ago so after all the badgering and the need for updates quick and easy. This is what fixed the issue at least for now.
1) Turn off Automatic Updates and reboot to stop the 100% CPU usage.
2) Use the following set of fixes I found at http://answers.microsoft.com/en-us/windows/forum/windows_xp-windows_update/windows-update-svchostexe-100-cpu-in-task-manager/6b372d8b-0ca4-4042-ba37-b2a7cdcdbd06 and written out below:
Please do the following.

Go to Start | Settings | Control Panel and double click Automatic Updates.

Checkmark the bottom option to disable automatic updates.

Click Apply/OK and then reboot.

Does svchost still consume 100% CPU cycles?

If it does, do the following.

Go to Start, Run, copy/paste this command and click OK: services.msc

In the list of Services, can you see Background Intelligent Transfer Service ?
It is usually directly under Automatic Update Service

If it’s not listed, please proceed as follows to register the BITS service.

Open the Windows Search tool, copy/paste the following and then click Search: qmgr.dll

Search should show that file in the following locations:

C:WINDOWSsystem32
C:WINDOWSServicePackFilesi386
C:WINDOWSsystem32bits

Provided they’re all present, do the following to register the service.

Go to Start, Run and copy/paste: regsvr32 qmgr.dll and click OK

Do the same with this file: regsvr32 qmgrprxy.dll

Reboot the system and then copy/paste this command into the Run field:
%windir%System32rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %windir%infqmgr.inf

If you’re prompted to insert the Windows installation CD, ignore that and in the dialog box at the bottom, change the path to C:WINDOWSServicePackFilesi386

Restart the PC again and then go to Services and you should be able to see BITS in the list.
Double click it and then on the General tab, click the Start button to try and start the service manually. This is just a test to ensure that it’s working correctly.

If you get Error 2: cannot find the file specified, go to Start, then Run again and copy/paste the following command and then click OK:
Reg add HKLMSYSTEMCurrentControlSetServicesBITSParameters /v ServiceDll /t REG_EXPAND_SZ /d %windir%System32qmgr.dll

Reboot again and then try once more to start BITS. It should work properly now, but in the unlikely event that it fails again, run the following command and then hit Enter:
Reg add HKLMSYSTEMCurrentControlSetControlBackupRestoreFilesNotToBackup

Reboot once more and then do the following.

Go to this link and install the IE8 cumulative November update:
http://www.microsoft.com/en-us/download/details.aspx?id=41074

Finally, go to the Windows Update site and you should be able to download normally.:fanfare:

I needed to do it all. I still have Auto Update DISABLED. I also found that if Windows Genuine Advantage is offered Do NOT accept the download and hide it from future offerings as on my wife’s totally legal Dell laptop it hung and caused CPU to be at 100% once again so I had to stop all through the Task Mgr. and roll back my system 15 minutes and reinstall the IE8 update and then proceed to the windows update site for the latest security updates. The average person will not go through this short but geeky process and say that it is time for a new computer. They would be correct in many cases.

Good luck to all. :cheers:

Reply | Quote

another clue about when it hits us

unverified, but seems to relate to either adobe pdf reader that had been used earlier
or possibly hotmail. maybe some interaction of using both.

sometimes svchost causes a wait on shutdown , sometimes not.
the best clue is that it might be adobe pdf related.
but could certainly be something else.

Reply | Quote

Read my spiel below; this cool utility that I posted there fixed my issue this month at least.

http://windowssecrets.com/forums/showthread//158381-Closing-a-long-year-of-Windows-patching?p=933141&viewfull=1#post933141

Reply | Quote

[post=933234]Ahem[/post]

Reply | Quote