wuauserv causing svchost memory usage to explode

Just a quick note: If you use Chrome as your main browser and rarely use IE it might be worth resetting IE.

Control Panel> Internet Options> Advanced> Reset> Ok.

Run IE 64bit and it will ask if you want to set it as your default browser or enable add ons Choose no.

Run IE 32bit and check the same.

Test svchost usage after a reboot.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ASUS
OS
Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
CPU
AMD C-60 APU with Radeon(tm) HD Graphics
Motherboard
ASUSTeK COMPUTER INC. X501U
Memory
4.00 GB
Graphics Card(s)
AMD Radeon HD 6290 Graphics
Sound Card
(1) AMD High Definition Audio Device (2) Realtek High Defi
Screen Resolution
1366 x 768 x 32 bits (4294967296 colors) @ 60 Hz
Hard Drives
Hitachi HTS545050A7E380 SATA Disk Device
Antivirus
Comodo CIS & FW, SecureAplus App Whitelisting, Threatfire
Browser
Cyberfox 64bit, Opera 64bit, Airfox
Other Info
Spy-The-Spy, HitmanPro.Alert, Norton Connect Safe, MJRegWatcher, BitDefender TrafficLight, Voodoo Shield, Zemana AntiMalware
Nod 32 ?

Hello Texas, Callender. I have the same issue and found this thread that matches in almos everything I have done. Just wanted to say that we even coincided on the AV Nod32, so I checked there and there is an option for Software Update. It may was Nod32 the one triggering wuauserv ?? I am now checking. But makes a lot of sence.
Thanks to both of you for the sequence you have posted here.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Samsung Serie 9
OS
W7 x64
CPU
Intel Core i5-3317U 1.70 Hz
Memory
4 MB Ram
Graphics Card(s)
Intel HD Graphics 4000
Hard Drives
128 SSD
Same issue..

Hi there,

I'm a System Administrator from Denmark, an we've been experiencing the exact same problem in our inviroment...

Not only at one pc, but at approx 100 pc's... In our inviroment we've set all of our pc's to automaticly update, but we use SCCM 2012 to distribute the updates..

I've been looking for a solution for months, and first i found an article supplying a batchscript, that actually did fix it for maby a week or two (now when i run the same script it fixes it for a day or two)... What the script did was reset all windows update agents and clean up temp files and so on...

Script is here:
@echo off
IF EXIST %temp%\wu2.txt GOTO :END

REM ==================================================================================
REM DESCRIPTION : This script resets all of Windows Update Agent settings.
REM AUTHOR : Luca Fabbri
REM VERSION HISTORY: 2.0 - Start
REM ==================================================================================

@echo 1. Stopping Windows Update, BITS, Application Identity, Cryptographic Services and SMS Host Agent services...
net stop wuauserv
net stop bits
net stop appidsvc
net stop cryptsvc
net stop ccmexec

@echo 2. Checking if services were stopped successfully...
sc query wuauserv | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 goto END

sc query bits | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 goto END

sc query appidsvc | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 sc query appidsvc | findstr /I /C:"OpenService FAILED 1060"
if %errorlevel% NEQ 0 goto END

sc query cryptsvc | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 goto END

sc query ccmexec | findstr /I /C:"STOPPED"
if %errorlevel% NEQ 0 sc query ccmexec | findstr /I /C:"OpenService FAILED 1060"
if %errorlevel% NEQ 0 goto END

@echo 3. Deleting AU cache folder and log file...
del /f /q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
del /f /s /q %SystemRoot%\SoftwareDistribution\*.*
del /f /s /q %SystemRoot%\system32\catroot2\*.*
del /f /q %SystemRoot%\WindowsUpdate.log

REM @echo 3. Renaming AU cache folder and log file...
REM del /f /q "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
REM ren %SystemRoot%\SoftwareDistribution *.bak
REM ren %SystemRoot%\system32\catroot2 *.bak
REM ren %SystemRoot%\WindowsUpdate.log *.bak

REM sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
REM sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

@echo 4. Re-registering DLL files...
cd /d %WinDir%\system32
regsvr32.exe /s atl.dll
regsvr32.exe /s urlmon.dll
regsvr32.exe /s mshtml.dll
regsvr32.exe /s shdocvw.dll
regsvr32.exe /s browseui.dll
regsvr32.exe /s jscript.dll
regsvr32.exe /s vbscript.dll
regsvr32.exe /s scrrun.dll
regsvr32.exe /s msxml.dll
regsvr32.exe /s msxml3.dll
regsvr32.exe /s msxml6.dll
regsvr32.exe /s actxprxy.dll
regsvr32.exe /s softpub.dll
regsvr32.exe /s wintrust.dll
regsvr32.exe /s dssenh.dll
regsvr32.exe /s rsaenh.dll
regsvr32.exe /s gpkcsp.dll
regsvr32.exe /s sccbase.dll
regsvr32.exe /s slbcsp.dll
regsvr32.exe /s cryptdlg.dll
regsvr32.exe /s oleaut32.dll
regsvr32.exe /s ole32.dll
regsvr32.exe /s shell32.dll
regsvr32.exe /s initpki.dll
regsvr32.exe /s wuapi.dll
regsvr32.exe /s wuaueng.dll
regsvr32.exe /s wuaueng1.dll
regsvr32.exe /s wucltui.dll
regsvr32.exe /s wups.dll
regsvr32.exe /s wups2.dll
regsvr32.exe /s wuweb.dll
regsvr32.exe /s qmgr.dll
regsvr32.exe /s qmgrprxy.dll
regsvr32.exe /s wucltux.dll
regsvr32.exe /s muweb.dll
regsvr32.exe /s wuwebv.dll

@echo 5. Removing WSUS Client Id...
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f

@echo 6. Resetting Winsock and WinHTTP Proxy...
netsh winsock reset
proxycfg.exe -d
netsh winhttp reset proxy

@echo 7. Starting SMS Host Agent, Cryptographic Services, Application Identity, BITS, Windows Update services...
net start ccmexec
net start cryptsvc
net start appidsvc
net start bits
net start wuauserv

@echo 8. Deleting all BITS jobs...
bitsadmin.exe /reset /allusers

@echo 9. Forcing AU discovery...
wuauclt /resetauthorization /detectnow

:END

copy \\Share\folder\wu2.txt %temp%\wu2.txt

As this fixes it only temporarily, Iv'e been searching for a solution that fixes it permenantly, and finaly i looks like MS has provided a fix: KB3050265 - take a look at: https://support.microsoft.com/en-us/kb/3050265

I haven't tested it yet, but i will do so today and post my result
 
Last edited:

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Costum Build
OS
Windows 7 x64 Enterprise
CPU
Core I7 950
Memory
16 GB
Testing too.

Thanks Thope DK. Am testing too Hope the fix Works. Already installed and manualy checked updates and didn't have back the dam long time demanding issue.
I don't think 4gb Ram could suddenly be small as MS suggested for the fix. (?)
Hope now is OK.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Samsung Serie 9
OS
W7 x64
CPU
Intel Core i5-3317U 1.70 Hz
Memory
4 MB Ram
Graphics Card(s)
Intel HD Graphics 4000
Hard Drives
128 SSD
Just a quick note to say that I fixed the problem on my home based machine and that's not the same as machines using a WSUS Server. Also note that eventually I performed a forced install of Windows Update Agent.

"Full Path To\WindowsUpdateAgent-7.6-x64.exe" /wuforce

Will download and install the suggested update and see what happens! Note: I have system image backups.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ASUS
OS
Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
CPU
AMD C-60 APU with Radeon(tm) HD Graphics
Motherboard
ASUSTeK COMPUTER INC. X501U
Memory
4.00 GB
Graphics Card(s)
AMD Radeon HD 6290 Graphics
Sound Card
(1) AMD High Definition Audio Device (2) Realtek High Defi
Screen Resolution
1366 x 768 x 32 bits (4294967296 colors) @ 60 Hz
Hard Drives
Hitachi HTS545050A7E380 SATA Disk Device
Antivirus
Comodo CIS & FW, SecureAplus App Whitelisting, Threatfire
Browser
Cyberfox 64bit, Opera 64bit, Airfox
Other Info
Spy-The-Spy, HitmanPro.Alert, Norton Connect Safe, MJRegWatcher, BitDefender TrafficLight, Voodoo Shield, Zemana AntiMalware
Solved :)

It looks like the MS hotfix did the trick, i've been talking to 2 out of 4 where the update was installed Thursday and they say that there have been no problems what so ever since...

Bonus info, if it hasn't fixed it i would have heard it, as the error slows login time of windows (including starting of outlook etc.) significantly

:) :) :)

/Thomas
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Costum Build
OS
Windows 7 x64 Enterprise
CPU
Core I7 950
Memory
16 GB
Hi, if the hotfix does not work another solution because it is svchost + windows management framework (possibly) you can go to control panal | admin tools | services -- find the 'superfetch' and double click it for options so you can first stop the service and then set its startup to disabled.
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Thinkpad'
OS
Debian Custom
CPU
I5 / I7
Memory
Never enough
Monitor(s) Displays
4+
Hard Drives
SSD
Internet Speed
NOS
Antivirus
What?
Browser
Mozilla
Very important: It is normal that Windows Update uses full CPU (e.g. 50%) for a very long time. I just spent many days trying everything possible, always stopping the update after giving up at ~3 hours of waiting. But in the end the solution was to simply wait for longer. I can confirm that a first time Windows Update can nowadays be stuck on the Checking for updates screen for at least 4 hours, while CPU is peaking and nothing else happens (except for the progress bar looping animation). This on a 2009 computer. On older computers it can probably something like 10 hours even. Most unbelievable thing ever. (And this has absolutely nothing to do with network problems, by the way.)
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Custom build
OS
Windows 7 Ultimate x64
CPU
Intel i7-3930K
Motherboard
Asus P9X79 WS
Memory
8 x 8 GB G.Skill RipjawsX DDR3 1600 MHz
Graphics Card(s)
Gigabyte GeForce GTX 970
Sound Card
RME HDSPe AIO
Monitor(s) Displays
Dell U2713HM
Hard Drives
Samsung 840 Evo SSD etc.
PSU
Corsair AX650W
Back
Top