When you use Automatic Updates to scan for updates or to apply updates to applications that use Windows Installer, you experience issues that involve the Svchost.exe process

NOTICE

The problem that the "Symptoms" section describes was corrected in Windows Update Agent 3.0 and in update 927891. These updates were distributed through Microsoft Update in June and July, 2007. If you are still experiencing a problem that resembles the one that this article describes, it may be a different problem. To troubleshoot similar problems, please see the "Similar problems and resolutions" section later in this article.

Symptoms

You use Automatic Updates to scan for updates or to apply updates to any applications that use Microsoft Windows Installer 3.1. After you do this, you experience issues when you use the following update mechanisms:

• Microsoft Update

• Windows Server Update Services (WSUS)

• The Microsoft Baseline Security Analyzer (MBSA) 2.0

• Microsoft Systems Management Server Inventory Tool for Microsoft Updates (SMS ITMU)

Some applications that use Windows Installer include Microsoft Office 2003, Microsoft Office XP, and Microsoft Windows Defender. These applications experience the following issues:

• The Svchost.exe process may spike the CPU usage to 100 percent during update detection or update installation. Also, the Svchost.exe process causes the computer to stop responding for various lengths of time.
  

• The Svchost.exe process produces an access violation during update detection or update installation. Additionally, you receive the following error message:
  

  SVCHOST.exe Application Error
  The instruction at 0x0745F2780 referenced memory at 0x000000000 the memory could not be read.

• The Svchost.exe process leaks memory during update detection or update installation.

Resolution

Microsoft provides the following updates to resolve these issues:

• Update 927891 resolves newly-discovered crashes that occur in the Svchost.exe process. Because of the access violations that update 916089 does not resolve, update 927891 also resolves the reported access violations that occur in the Svchost.exe process.
  
  Note These secondary access violations were not exposed until after update 916089 was applied. The secondary access violations are not caused by update 916089.
  
  For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  
  

  927891 You receive an access violation error and the system may appear to become unresponsive when you try to install an update from Windows Update or from Microsoft Update
  
  

The WSUS version 3.0 client program has been released to help address the following issues:

• You may experience prolonged high CPU usage when you scan the computer for updates or when you install updates.

• The computer stops responding (hangs) when you scan the computer for updates or when you install updates.

To resolve these issues, you must install update 927891 and the new WSUS 3.0 client.

Notes

• To resolve this issue, you must be using version 374 or a later version of the Windows Update Agent.
  
  
  For more information about the latest version of the Windows Update Agent, click the following article number to view the article in the Microsoft Knowledge Base:
  
  

  946928 Information for network administrators about how to obtain the latest Windows Update agent
  
  

• Update 927891 includes update 916089.

• Although this solution should resolve the computer unresponsiveness and reduce the time that you experience high CPU usage, this solution does not completely eliminate high CPU usage. However, after you apply these updates, the computer should run in a typical manner.

Status

This problem was corrected in Windows Update Agent 3.0 and update 927891.

More Information

Update 927891 fully replaces update 916089. If you are affected by the issues that are described in the "Symptoms" section, please follow these steps:

1. Apply update 927891.

2. Restart the computer.

If any of the issues remain, contact Microsoft Customer Support.

Notes

• The WSUS version 3.0 client program is fully compatible with WSUS 2.0 SP1.

• The WSUS version 3.0 client program has been made available to the WSUS 2.0 SP1 server infrastructure so that clients can "SelfUpdate" to the newer WSUS 3.0 version. This update to the SelfUpdate tree is located in the Critical Updates classification and is identified as KB936301.
  

Similar problems and resolutions

If you are still experiencing a problem that resembles the one that this article describes, it may be a different problem.

For more information about similar problems and resolutions, click the following article numbers to view the articles in the Microsoft Knowledge Base:

939273 You cannot deploy software updates on a computer that is running Microsoft Windows XP or Microsoft Windows Server 2003

932762 The Service Host process may stop unexpectedly in Windows Server 2003

931852 Error messages when you start a Windows XP-based computer and then try to download Windows Updates

910666 The Svchost.exe process may end unexpectedly on a Windows Server 2003-based computer

894538 When Internet Authentication Service receives an unknown attribute in a packet, a Windows Server 2003-based Internet Authentication Service server stops responding

927385 You receive an error message after a Windows XP-based computer runs an automatic update, and you may be unable to run any programs after you close the "svchost.exe - Application Error" error message dialog box

If these articles do not help you resolve the problem or if you experience symptoms that differ from those that this article describes, please search the Microsoft Knowledge Base for more information. To search the Microsoft Knowledge Base, visit the following Microsoft Web site:

http://support.microsoft.com

Then, type the text of the error message that you receive, or type a description of the problem in the Search Support (KB) field.