CPU usage 100% after doing Microsoft Windows Security Bulletin Summary 6

[1Zeus]

After downloading and applying the updates that microsoft put out today, by system CPU is 100% in task manager. The system cpu usage is at 100% even when booting into safemode.
The system is dog slow now, I can't even get into the control panel to uninstall the security updates. Please Help.

 

[Rhombus65]

1Zeus:

I just downloaded all available crtical updates for my W2K machine and do not have any problems.

I run a pretty lean machine though and I work hard to keep it clean.

I read a lot posts about problems with updates but do not understand what goes wrong, but like I said I do not run a whole lot of apps.

Sometimes I think that the updates make vulnurabilities surface. Kind of like when you try to upgrade to W2K Native Mode.

It may?? help you to see bcastners faq608-4650. It is an awesome faq.



Jim: A+, MCP W2k, Master Electrician

"The important thing is to not stop questioning. Curiosity has its own reason for existing..."
-Albert Einstein

 

[bcastner]

http://support.microsoft.com/?kbid=830846

 

[bcastner]

Use Control Panel, Add/Remove Programs, and remove KB35732

There have been credible reports of this particular Hotfix causing the symptoms you describe on some Win2k installations.

Note: This is best done in Safe Mode.

 

[1Zeus]

I have tried to do it in safe mode, but even in safe mode the CPU usage is pegged at 100%. I can't bring up the Add/Remove Programs. Help!!!!!!!!!

 

[bcastner]

I agree it will take a while, but it will come up.

In the alternative:
Start, Run, CMD
c:
cd \WINDOWS\$NtUninstallKB835732$\spuninst
spuninst.exe

You should reboot.

Based on: MS04-011 - Security Update for Microsoft Windows (KB Q835732)

 

[1Zeus]

can the updates be removed from a command prompt?

 

[bcastner]

I guess we posted at the same time, see my note above how to do exactly that.

 

[1Zeus]

Running spuninst.exe now. I was able to boot into safe mode with command prompt. I will let you know if it works, it have been in Step 1 "Inspecting Current Configuration" for about 10 minutes now. I will let it run it's course.

 

[bcastner]

A faster way was offered in one newsgroup discussion:

After installing Security fix KB835732, the SYSTEM.exe
procress uses up 99% of CPU time, and make the system non-
responsive.

To unistall it, I did the following
(1) Boot into Safe mode.
(2) Run TaskManager - and noticed that the SYSTEM process
was using 99% of the CPU time.
(3) From TaskManager set the Priority of the EXPLORER
process to REALTIME, so that I can get to the control
panel.
(4) Run ADD/REMOVE PROGRAM from control panel.
(5) Go back to TaskManager and set the Priority of
MSHTA.exe to REALTIME, so that the ADD/REMOVE PROGRAM can
get some CPU time.
(6) Select and Remove "Windows 2000 Hotfix - KB835732".
(7) Go back to TaskManager and set the Priority
of "SPUNIST.exe" to REALTIME, for the uninstall program to
run.
(8) Wait a few minutes, and the uninstall program will
eventually ask you to click FINISH to reboot the machine.
It took a long time for the system to shutdown and I just
unplugged the power.
(9) The machine should become normal after reboot.

 

[1Zeus]

I believe I eneded up reading the same thing, but in my case setting the options to realtime did not help. It took a total of 56 minutes for the system to complete the uninstall and reboot.

Has Microsoft come up with a reason for this problem? or a fix for it? :-;

 

[bcastner]

It enables IPSEC policy even if Group Policy denies the application of IPSEC rules.

 

[howdedo]

I had the exact same problem with the Microsoft Security Update KB35732: system process consuming 100% of the cpu.

I'm usually pretty responsive in regards to keeping up with the security updates, but I've never had any serious problems with them prior to this. Now, I'm concerned about rolling this update out to other desktops.

Any ideas why this doesn't work on some systems?

Thanks for the great info!

 

[BionicJohn]

> Any ideas why this doesn't work on some systems?

Let me throw a spanner in the works.

I was suffering from this but didn't unduly wory about it. I upgraded my CPU from an AthlonXP 1900+ to an Athlon 2600+ and now the system idles at 0%-1% and the hard disk activity LED remains off. The only hardware change to the system was the CPU and the associated change of the system bus from 266MHz to 333Mhz

Conclude what you will!

Iechyd da! John
Glannau Mersi, Lloegr.

 

[bcastner]

It is not clear why KB835732 causes issues with some Win2k machines. (Note: there are no credible problem reports for Windows XP Professional).

Over 95% of Win2k clients do not report a problem. But your question is why the issue with some Win2k clients.

. It is not clear at the moment;
. It is a reproducable issue in certain Group Policy settings, noted above;
. There are some credible arguments that it is a video driver issue in some settings;

Install the security Hotfixes, with the exception of KB835732

If you administrate a number of essentially similar workstations, install, after a reboot, a test client. If it works, roll-out the Hotfix.

If your test workstation has the issues described earlier in this thread, wait for a little while.

Microsoft is fully aware that there can be Win2k issues with this particular Hotfix.

Best,
Bill Castner

 

[1Zeus]

Thanks to all,

We some 50 + systems in our office. Out of that, the 1 system that had this issue, I have 6 identical hardware. the 6 systems were purchased at the same time and have consecutive serial numbers, but only 1 machine had the problem. After getting the machin back up and running. I have checked driver versions. The video card are all the same driver. I woule believe that the hardware are all the same revisions, but I have not taken a look.

 

[bcastner]

I decided to roll the hotfix out, and do a case-by-case removal if it proved problematic.

As a guess something in the order of 1 in 200 machines has an issue with the hotfix.

 

[gregarican]

This was one noted issue with the patch. Another one is that the next system restart there is a BSOD STOP 0x1d error --- DRIVER_IRQ_NOT_LESS_OR_EQUAL. Thank God it's a transient error and another hard reboot eliminates the condition. If not I was about to soil myself thinking of all my corporate (i.e. - hardware/software standardized) workstations collective fate.

I don't think that Microsoft can claim that they had to rush this patch to release since a lot of the vulnerabilities were brought to their attention over 6 months ago. This is almost as big of a fiasco as the release of Windows NT 4.0 Service Pack 6. That broke the TCP/IP stack and led to (of course SP6a). Boy I sure had a lot of useless servers back then for awhile.

 

[USMCSysAdmin]

Here is another note with this windows patch. I'm sure some of you have heard of the BSOD "STOP: c00000135 unable to locate DLL. The dynamic link library winsrv could
not be found in the specified Default local path." Microsoft suggest this is usually a hardware problem but of course it usually isn't. Now I was having a problem with getting into windows at all on a computer. The way I tried to fix it the first time was going into Console Repair mode and going to the folder C:\winnt\$NtUninstallKB835732$\spuninst\ and running spuninst.exe which wouldn't work. What worked is in the same directory (C:\winnt\$NtUninstallKB835732$\spuninst\) I typed "Batch spuninst.txt" This deleted the old service pack files and reinstalled the new ones. I booted up and it was good to go! I'm posting this because it is a possibility it might work for those of you who cant get into anything because of your cpu usage being so high. Hope it helps.

 

[waistedtime]

Just a little something extra. I was able to look at the event logs with ERD Commander. Saw some PNP problem indications, shut down the PNP Service, and rebooted. At least the system became responsive. That made the uninstall of KB35732 mucho easier. I noted a V1.1 of the patch, dated 4-21. Thought, cool, let's try it. Now waiting for V1.2
BTW, this is the only place I've looking that has the answer, yeah Google!