XP32, Windows Update & svchost 100%: OTHER solutions?

[Tomcat76]

This topic has been discussed to death, but since I wasn't able to solve it using the advise found around the Web, I was hoping to get ADDITIONAL possible solutions to this problem.  If it doesn't lead us anywhere, I'm OK with it being closed or terminated.

It concerns a computer (not my main rig) that is running XP 32-bit which is primarily used by my 3-year-old niece to watch YT videos.  I wanted to test the POSReady 2009 registry edit on it before applying it to my main rig, which is also running XP 32-bit.  The problematic computer has had Automatic Updates disabled ever since Microsoft ended extended support.  The problems I have observed:

1) When enabling Automatic Updates or when going to Windows/Microsoft Update with Internet Explorer, an instance of svchost immediately reaches 50% of CPU usage (100% of one core) and both the CPU fan and rear exhaust fan are blowing away to lower the temp on the "PresHott" CPU which is at around 80°C then.  This doesn't stop until I close IE or reboot the PC.

2) The search for updates using Windows or Microsoft Update never finishes.

What I have done in an attempt to fix it:

1) Disabled anti-virus.  No dice.

2) Manually renamed the catroot2 folder and deleted the SoftwareDistribution\Download in Safe Mode.  No change.

3) Changed the startup type of the Background Transfer Intelligence Service (BITS) from Manual to Automatic.  Didn't help.

4) Reset IE8 to default.  No change.

5) Followed the instructions found here to install Windows Update Agent 3.0 (which was already installed), and to run a batch file that re-registers a whole bunch of system files and fixes the catroot2 and SoftwareDistribution folders (which didn't help either).  I didn't download KB927891 because the link refers to an executable intended for XP 64-bit.

6) Created an updated WUA 3.0 installer using a batch script by MSFN.org members and installed it, but it complained it was already installed.  The installed binaries are indeed the same.

7) Ran the command sc config wuauserv type= own to have Windows Update run in an svchost process of its own.  No dice.

8) Deleted "Networkservice" under HKLM\Software\Microsoft\Windows NT\CurrentVersion\SvcHost after backing it up.  Didn't help, so I restored it.

9) "Downgraded" from Microsoft Update to Windows Update.  No dice.

10) Installed the latest cumulative update for IE8 for Windows XP 32-bit that I could find, which was the KB4018271 update from May 2017 (with binaries from April 2017).  No dice.

11) Installed the latest cumulative update for IE8 for PosReady 2009, which appears to be the KB4025252 update from July 2017.  It installed without a glitch, but it didn't help resolve the Windows Update problem.

12) Uninstalled IE8, rebooted, re-installed IE8 "with updates" and rebooted.  No dice.  Installed KB4025252 and rebooted.  Still the same.

13) Just let Windows Update run.  The CPU fan and rear exhaust fan are blowing away like there's no tomorrow and the CPU temp is over 80°C, which I don't like.  I let it run for more than half a day and it was still searching, so I closed IE.

So... What else is there to try?  It could be that more updates than the latest cumulative update for IE8 are needed to satisfy Windows Update.  A list of prerequisite updates like the ones for Windows Vista and Windows 7 might be of help.

Ideas?

[jaclaz]

48 minutes ago, Tomcat76 said:

13) Just let Windows Update run.  The CPU fan and rear exhaust fan are blowing away like there's no tomorrow and the CPU temp is over 80°C, which I don't like.  I let it run for more than half a day and it was still searching, so I closed IE.

ONLY as a side note, this doesn't sound right.

Maybe - before and outside the Windows Update issue, disassembling the CPU heatsink and fan, thoroughly clean them and apply some new thermal paste wouldn't be IMHO a bad idea.

jaclaz
 

[Destro]

This is a old problem that MS never fixed.  It's the kinda issue that effects multiple configurations the same way.  Some solutions that work for some people don't work for other people.  I have this issue when I have office 2003 installed on an XP machine and I have Microsoft update instead of just the standard update installed.

Try to run this file and see if it fixes your problem.  Also install the latest IE 8 cumulative hot fix.  Its on the windows update catalog.

If you don't have MS office then you don't need MS update, Try to use normal Windows update and disable MS update.  Its in the options.  

Last thing you may wat to try is somone made a standalone windows update for XP like what they have in win 7 but I never tried it.

https://www.wincert.net/forum/index.php?/topic/9907-official-windows-update-agent-767600320/

fix_svchost.bat

https://www.catalog.update.microsoft.com/Search.aspx?q=internet+explorer+8

regsvr32 msident.dll /s
regsvr32 msieftp.dll /s
regsvr32 xmsconf.ocx /s
regsvr32 ils.dll /s
regsvr32 msoeacct.dll /s
regsvr32 inetcomm.dll /s
regsvr32 msdxm.ocx /s
regsvr32 dxmasf.dll /s
regsvr32 l3codecx.ax /s
regsvr32 acelpdec.ax /s
regsvr32 mpg4ds32.ax /s
regsvr32 voxmsdec.ax /s
regsvr32 danim.dll /s
regsvr32 Daxctle.ocx /s
regsvr32 lmrt.dll /s
regsvr32 datime.dll /s
regsvr32 dxtrans.dll /s
regsvr32 dxtmsft.dll /s
regsvr32 WEBPOST.DLL /s
regsvr32 WPWIZDLL.DLL /s
regsvr32 POSTWPP.DLL /s
regsvr32 CRSWPP.DLL /s
regsvr32 FTPWPP.DLL /s
regsvr32 FPWPP.DLL /s
regsvr32 WUAPI.DLL /s
regsvr32 WUAUENG.DLL /s
regsvr32 ATL.DLL /s
regsvr32 WUCLTUI.DLL /s
regsvr32 WUPS.DLL /s
regsvr32 WUWEB.DLL /s
regsvr32 wshom.ocx /s
regsvr32 wshext.dll /s
regsvr32 vbscript.dll /s
regsvr32 scrrun.dll mstinit.exe /setup /s
regsvr32 msnsspc.dll /SspcCreateSspiReg /s
regsvr32 msapsspc.dll /SspcCreateSspiReg /s
regsvr32 /s urlmon.dll
regsvr32 /s mshtml.dll
regsvr32 /s shdocvw.dll
regsvr32 /s browseui.dll
regsvr32 /s jscript.dll
regsvr32 /s vbscript.dll
regsvr32 /s scrrun.dll
regsvr32 /s msxml.dll
regsvr32 /s actxprxy.dll
regsvr32 /s softpub.dll
regsvr32 /s wintrust.dll
regsvr32 /s dssenh.dll
regsvr32 /s rsaenh.dll
regsvr32 /s gpkcsp.dll
regsvr32 /s sccbase.dll
regsvr32 /s slbcsp.dll
regsvr32 /s cryptdlg.dll
regsvr32 /s schannel.dll
regsvr32 /s oleaut32.dll
regsvr32 /s ole32.dll
regsvr32 /s shell32.dll
regsvr32 /s initpki.dll
regsvr32 /s msscript.ocx
regsvr32 /s dispex.dll
regsvr32 jscript.dll /s
del %temp% /Q /F
net stop wuauserv
ren %windir%\system32\catroot2 catroot2.old
cd /d %windir%\SoftwareDistribution
rd /s DataStore /Q
regsvr32 wuapi.dll /s
regsvr32 wups.dll /s
regsvr32 wuaueng.dll /s
regsvr32 wucltui.dll /s
regsvr32 wuweb.dll /s
regsvr32 msxml.dll /s
regsvr32 msxml2.dll /s
regsvr32 msxml3.dll /s
regsvr32 urlmon.dll /s
net start wuauserv
exit

Edited August 6, 2017 by Destro
explaination

[Tomcat76]

@jaclaz:

That PC needs regular attention since it's a Prescott in a small enclosure (HP Microtower).  I admit it's been a while since the last time.  When cleaned up, the CPU runs at 72~75°C on full load.

@Destro:

I already tried those, but thanks anyway :-)

[jumper]

I wonder what the app is actually doing that whole time.... What does your network traffic look like during the search? And your file system traffic?

[dencorso]

The 100% CPU usage itself is just another symptom, not the true issue. On multicore CPU usually it can use 50% of two cores, and yet not finish looking for updates after mor than 17h !!! However, if one patiently finds by hand all the missing Office updates and then applies them manually (usually it's not too tedious, since most don't require rebooting), then the MS Update works as intended and finds all other needed updates in 2h or less. This is equivalent to use the Windows Update site instead, because that site does not search for Office updates, but it has the advantage that, once done, one has the Office up-to-date and, usually, if applying updates once a month, the new Office updates dont cause the issue again or, when they do, it's just a matter of applying just a few new Office updates by hand. AFAIK, up to now, nobody found out which Office updates do cause the delay and which don't. It seems that any Office versions do cause this issue, regardless of which Office it is. This is all I currently know about this issue.

[Destro]

Ya thats what I think That I only have this problem with "Microsoft update" not windows update and it's only when I have office 2003 installed.  But it may happen with other versions like 2007 i haven't tested that.  I found my 2003 office hotfixes I have all of them since SP3 full ENU installers.  I am glad I saved them since MS has now deleted them off of their site.  If there was enough interest in it, Id be willing to break/fix a XP VM with 2003 office and try to figure out which update/update actually causes this problem but i don't know if its worth it.

In the past I have been able to successfully run microsoft update on a vanilla 2003 office Source, But the moment I start apply patches to it or if it is even fully patched update breaks.

Edited August 7, 2017 by Destro

[dencorso]

The Office 2007 compatibility pack and its updates also does cause the same issue.

[Destro]

Can you try to manually apply this DLL? 

rename to MSI.DLL

I think it has something to do with windows installer 4.5 and Office/MS updates.  Like that it doesn't include this fix. https://support.microsoft.com/en-us/help/927891/you-receive-an-access-violation-error-and-the-system-may-appear-to-bec

That hotfix replaces this one.

maybe the fix is to downgrade MSI installer to a deprecated version.  Maybe the reason that we all have this problem is because we all used the same update packs that included installer 4.5

https://support.microsoft.com/en-us/help/916089

http://www.mediafire.com/file/a7zd9a0478r6baj/WindowsXP-KB927891.7z

Last thing try to unreg the msi installer and instal 3.1 instead

https://answers.microsoft.com/en-us/windows/forum/windows_xp-update/how-to-uninstall-updated-via-windows-installer-45/6877ba2e-6958-4fe5-a320-17b3bd87bfd4

Edited August 7, 2017 by Destro

[Tomcat76]

14 hours ago, jumper said:

I wonder what the app is actually doing that whole time.... What does your network traffic look like during the search? And your file system traffic?

By observing the network icon in the system tray, nothing much is happening; it flashes briefly just once or twice every minute.  I haven't used any special tool to monitor traffic, though.

Incidentally, I seem to have fixed it on the PC at hand.  I let Microsoft Update search for updates once again, and then inspected WindowsUpdate.log in the %WINDIR% folder.  Then, I searched Google for some of the errors and warnings that appeared, and stumbled upon a site that suggested to remove/rename the entire SoftwareDistribution folder (after stopping wuauserv), instead of just the SoftwareDistribution\Download subfolder.  After rebooting the machine, Microsoft Update gave me the list of updates to install in less than a minute.  It's now installing update 57 of 78.  :-)

[Tomcat76]

One problem: on attempting to install the May 2017 cumulative rollup for .Net Framework 3.0 SP2 that is offered, the PC reboots itself immediately.  This causes the SoftwareDistribution folder to become corrupt once again.  Luckily, the same fix (delete entire SoftwareDistribution folder) fixes it.

According to an entry in Event Viewer, the update doesn't apply to my PC.  But why would it have to trigger an automatic reboot?

Edited August 7, 2017 by Tomcat76

[jumper]

> the PC reboots itself immediately. This causes the SoftwareDistribution folder to become corrupt once again.

This sounds like the HDD is getting reset before all data is written. You might want to disable write caching when doing these updates.

[Destro]

I was able to delete windows installer 4.5 files and and replace them with a 3.1 installer files and add the DLL from 3.1 that is supposed to fix the redline svchost issue, Re registered them and was able to download updates, and install them still , I don't have office 2003 installed but I am gonna install office 2003 on my fully patched vm with compatibility packs and try to patch it and see if I run into issues.  I'll let you know.

I am curious about.  Microsoft update forced me to install msiexec.exe 4.5 MSI.dll 4.5 and msihnd.dll 4.5, however it did not replace the other 2 files that I replaced msisip.dll 3.1 and msimsg.dll 3.1.

Edited August 8, 2017 by Destro

[Destro]

I have the solution.  I figured out how to fix it.  This only solves the problem with XP and office 2003 With the 2007 compatibility pack. causing SVChost to redline to 100% for hours.  This does not fix other installs.

There is an Actual update order.  I know it sounds totally ridiculous but its true.  The problem is not the 2007 compatibility pack.  It is the compatibility pack SP3.

1. Install clean Office with clean SP3.  I haven't tested Hotfix integration into the source.

2. Run windows update and only install the office 2003 updates/ Alternatively if you have a 100% accurate list you could do it manually.

3. Now install Fileformatconverters.exe

4. Install Office 2007 compatibility pack SP3.

5.  Uninstall Office Compatibility pack sp3. ( just the SP3 don't uninstall the compatibility pack.) SP3 should be below the compatibility pack when you view all updates.)**The converter pack listed above it will disappear but it's really not gone***

6. Run windows update and install the updates for just the compatibility pack.

7.  Download kb3127894, kb3203438, kb3191897

8. Install Office converter pack  2007 SP3.

9.  Manually apply the 3 patches in step 7.

10. Run windows update and reapply the some of the patches patches you installed in step 4. It's not all.

Edited August 8, 2017 by Destro

[jaclaz]

4 hours ago, Destro said:

1. Install clean Office with clean SP3.  I haven't tested Hotfix integration into the source.

2. Run windows update and only install the office 2003 updates/ Alternatively if you have a 100% accurate list you could do it manually.

3. Now install Fileformatconverters.exe

4. Install Office 2007 compatibility pack SP3.

5.  Uninstall Office Compatibility pack sp3. ( just the SP3 don't uninstall the compatibility pack.) SP3 should be below the compatibility pack when you view all updates.)**The converter pack listed above it will disappear but it's really not gone***

4. Run windows update and install the updates for just the compatibility pack.

5.  Download kb3127894, kb3203438, kb3191897

6. Install Office converter pack  2007 SP3.

7.  Manually apply the 3 patches in step 5.

8. Run windows update and reapply the some of the patches patches you installed in step 4. It's not all.

9. I know this sounds totally ridiculous but this is what you have to do.

More than ridiculous it seems (very) confusing.

The step 3 talks of a "Fileformatconverters.exe" file without any references.

The step 7 references 3 patches in step 5 that aren't.

The step 8 makes no sense whatsoever.

Maybe you could try re-checking the steps you listed and make them more clear.

Ideally you should check if you actually can replicate your instructions/steps following ONLY what you have written and add at each step what you omitted (because you already know it).

jaclaz