wuaueng.dll high CPU and Disk Usage

J

John Gregory

I have a laptop, IBM T-60 with Windows XP, SP2 that has been nonresponsive
after startup.

On further investigation, I found that svchost is at 100% CPU, with
wuaueng.dll being the actual culprit. If I let this service continue to run,
it peaks out at around 3.5 to 4 Gb of disk I/O read bytes.

I have tried several of the published fixes for this, stopping the service,
renaming or erasing the folder, etc. but it keeps coming back with the same
problem.

Is there a way to kill this without damaging the system?
 
R

Ron Badour

Go to the Control Panel, Automatic Updates and try turning it off. If this
cures the problem, then turn it back on to see if the problem returns. If
it does, then go with manual versus automatic updates.

--
Regards

Ron Badour
MS MVP
Windows Desktop Experience
 
J

John Gregory

It took a while to sort out, the Automatic Update menu was greyed out, and I
had to find the correct registry keys to fix.

Disabling the AU seems to be working, the computer started up and ran
normally.

Thank you for your help.
 
M

MowGreen [MVP]

Locate wuaueng.dll in %windir%\system32, right click it, choose
Properties, click the Version tab.
Which V. is it, John ?
The latest one is V. 7.2.6001.788

Is a 3rd party firewall being used ? If so, the high CPU issue *may* be
occurring due to the firewall blocking the Windows Update Agent [WUA]
from contacting the update servers, thus, diabling AU will resolve the
CPU issue, but not be needed to resolve this issue.

AFAIK, high CPU issues associated with the WUA were *never* caused by
wuaueng.dll, rather, the issue was caused by thread modeling involving
the WUA and msi.dll - http://support.microsoft.com/kb/927891/

" The updated Windows Client changes the thread modeling to move MSI
scans to a thread that is separate from the user interface. "


MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============
 
J

John Gregory

The wuaueng.dll version is 7.1.6001.65

Turning off windows update does solve the immediate issue of high CPU usage.
To experiment, I tried various settings (notify... download...etc.), and
with every one except disable, the problem occurs.

Our IT group recently installed a new firewall with semi-disastrous results,
however they seem to have it under control now. I have not been able to find
anyone else who seems to be having this issue, and we all share the same
connection and firewall.

The article you mentioned shows WAU 3.0 update. Is this a newer version
than what I already have? How do I find out?


MowGreen said:
Locate wuaueng.dll in %windir%\system32, right click it, choose
Properties, click the Version tab.
Which V. is it, John ?
The latest one is V. 7.2.6001.788

Is a 3rd party firewall being used ? If so, the high CPU issue *may* be
occurring due to the firewall blocking the Windows Update Agent [WUA]
from contacting the update servers, thus, diabling AU will resolve the
CPU issue, but not be needed to resolve this issue.

AFAIK, high CPU issues associated with the WUA were *never* caused by
wuaueng.dll, rather, the issue was caused by thread modeling involving
the WUA and msi.dll - http://support.microsoft.com/kb/927891/

" The updated Windows Client changes the thread modeling to move MSI
scans to a thread that is separate from the user interface. "


MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============



John said:
It took a while to sort out, the Automatic Update menu was greyed out, and I
had to find the correct registry keys to fix.

Disabling the AU seems to be working, the computer started up and ran
normally.

Thank you for your help.

:
 
M

MowGreen [MVP]

The article you mentioned shows WAU 3.0 update. Is this a newer version
than what I already have? How do I find out?

It's WUA and yes, it is a later Version then the one installed on your
system. Check the Versions of these files located in WINDOWS\system 32

cdm.dll
wuapi.dll
wuauclt.exe
wuauserv.dll
wucltui.dll
wups2.dll
wups.dll
wusetup.exe
wuweb.dll

They should all show V. 7.2.6001.788 to be at the latest version. If
they are not, suggest you use the links in the KB article to obtain the
latest and greatest.
Stop the Windows Update service prior to installing it.
If BITS is enabled on Startup, then stop that, too.
Even then, you may need to add /wuforce to override the files now
installed -
http://www.bleepingcomputer.com/blogs/mowgreen/index.php?m=9&y=2007

MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============



John said:
The wuaueng.dll version is 7.1.6001.65

Turning off windows update does solve the immediate issue of high CPU usage.
To experiment, I tried various settings (notify... download...etc.), and
with every one except disable, the problem occurs.

Our IT group recently installed a new firewall with semi-disastrous results,
however they seem to have it under control now. I have not been able to find
anyone else who seems to be having this issue, and we all share the same
connection and firewall.

The article you mentioned shows WAU 3.0 update. Is this a newer version
than what I already have? How do I find out?


:

Locate wuaueng.dll in %windir%\system32, right click it, choose
Properties, click the Version tab.
Which V. is it, John ?
The latest one is V. 7.2.6001.788

Is a 3rd party firewall being used ? If so, the high CPU issue *may* be
occurring due to the firewall blocking the Windows Update Agent [WUA]
from contacting the update servers, thus, diabling AU will resolve the
CPU issue, but not be needed to resolve this issue.

AFAIK, high CPU issues associated with the WUA were *never* caused by
wuaueng.dll, rather, the issue was caused by thread modeling involving
the WUA and msi.dll - http://support.microsoft.com/kb/927891/

" The updated Windows Client changes the thread modeling to move MSI
scans to a thread that is separate from the user interface. "


MowGreen [MVP 2003-2009]
===============
*-343-* FDNY
Never Forgotten
===============



John Gregory wrote:

It took a while to sort out, the Automatic Update menu was greyed out, and I
had to find the correct registry keys to fix.

Disabling the AU seems to be working, the computer started up and ran
normally.

Thank you for your help.

:



Go to the Control Panel, Automatic Updates and try turning it off. If this
cures the problem, then turn it back on to see if the problem returns. If
it does, then go with manual versus automatic updates.

--
Regards

Ron Badour
MS MVP
Windows Desktop Experience




I have a laptop, IBM T-60 with Windows XP, SP2 that has been nonresponsive
after startup.

On further investigation, I found that svchost is at 100% CPU, with
wuaueng.dll being the actual culprit. If I let this service continue to
run,
it peaks out at around 3.5 to 4 Gb of disk I/O read bytes.

I have tried several of the published fixes for this, stopping the
service,
renaming or erasing the folder, etc. but it keeps coming back with the
same
problem.

Is there a way to kill this without damaging the system?
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top