wuauclt.exe stealing CPU constantly. No access to Windows Update

Hi; i have tried several fixes and patches and whatever they are called! When
I try to connect to windows update the system slows down and perhaps after 10
minutes I "get through" and Windows Update checks my computer. Then I receive
an error message > cannot update. The process wuauclt.exe runs constantly
form startup and steals 50% CPU. When I try to shut down the process it just
restarts again. Trying to shut down the process via cmd does not function
either > get the message: the process cannot be stopped. This is the latest
registry in the windows update log file:
2007-05-29 17:47:51:265 3768 970 Misc = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-05-29 17:47:51:265 3768 970 AUClnt FATAL: Error: 0xc8000408. wuauclt
datastore: failed to spawn COM server
2007-05-29 17:47:51:375 780 d38 DtaStor FATAL: DS: Out of proc datastore
process exited with error 0xc8000408 before signalling ready event.

Anyone?

XP Pro - *right* click C:\ (or the *root drive*), choose Properties,
Security
Add System with Full Control
XP HomeEdition - boot to Safe Mode to access the Security tab by logging
on as Admin

Specifically, what 'fixes and patches and whatever they are called' were
installed ?


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


Bjoern wrote:

> Hi; i have tried several fixes and patches and whatever they are called! When
> I try to connect to windows update the system slows down and perhaps after 10
> minutes I "get through" and Windows Update checks my computer. Then I receive
> an error message > cannot update. The process wuauclt.exe runs constantly
> form startup and steals 50% CPU. When I try to shut down the process it just
> restarts again. Trying to shut down the process via cmd does not function
> either > get the message: the process cannot be stopped. This is the latest
> registry in the windows update log file:
> 2007-05-29 17:47:51:265 3768 970 Misc = Process:
> C:\WINDOWS\system32\wuauclt.exe
> 2007-05-29 17:47:51:265 3768 970 AUClnt FATAL: Error: 0xc8000408. wuauclt
> datastore: failed to spawn COM server
> 2007-05-29 17:47:51:375 780 d38 DtaStor FATAL: DS: Out of proc datastore
> process exited with error 0xc8000408 before signalling ready event.
>
> Anyone?

Bjoern <> wrote:

> Hi; i have tried several fixes and patches and whatever they are
> called! When I try to connect to windows update the system slows down
> and perhaps after 10 minutes I "get through" and Windows Update
> checks my computer. Then I receive an error message > cannot update.
> The process wuauclt.exe runs constantly form startup and steals 50%
> CPU. When I try to shut down the process it just restarts again.
> Trying to shut down the process via cmd does not function either >
> get the message: the process cannot be stopped.

Although your description does not match the usual symptoms, it would be
worth upgrading to the latest versions of Windows Update, and then checking
for any symptoms remaining after that, in case the issue is now fixed.
Could you also confirm whether you are trying to use "Windows Update" or
"Microsoft Update", as stated in the heading of the update web page.

Before doing the items below, ensure that you have disabled all 3rd-party
anti-virus, anti-spyware, popup-blocker, download accelerator, or firewall.
If you disabled a 3rd-party firewall, then re-enable Windows Firewall for
the duration.

You might need to stop Automatic Updates while you apply these two fixes:
open a command prompt window and type the command:

net stop wuauserv

For a fix to the above problem, please do BOTH of the following:

1. (not for Vista) If your update history shows that you do not yet have
update KB927891 installed, then download and install update KB927891 ver3:
<http://support.microsoft.com/kb/927891>
and then restart Windows.

2. For 32-bit systems, download and save to hard disk, and then install:
<http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe>

If this produces an error message about "Update agent already
installed", then execute the installer again manually, with parameter
/wuforce as in (at a comand prompt window):

WindowsUpdateAgent30-x86.exe /wuforce

Then visit Microsoft Update again, and report back whether your problem is
fixed.

--
Robin Walker [MVP Networking]

Well, i thougt it was a problem with wuauclt.exe because i did not have the
latest updates from Windows Update. I have them now, after manual
installation. That was what i meant with "fixes and pathes and so on"...> bad
english I guess! Anyway; i have rebooted to safe mode and checked full access
for "SYSTEM" under the security tab. It was allready set to full access....
so ive still got the problem. Thank you anyway for your reply and suggestion.

"MowGreen [MVP]" wrote:

> XP Pro - *right* click C:\ (or the *root drive*), choose Properties,
> Security
> Add System with Full Control
> XP HomeEdition - boot to Safe Mode to access the Security tab by logging
> on as Admin
>
> Specifically, what 'fixes and patches and whatever they are called' were
> installed ?
>
>
> MowGreen [MVP 2003-2007]
> ===============
> *-343-* FDNY
> Never Forgotten
> ===============
>
>
> Bjoern wrote:
>
> > Hi; i have tried several fixes and patches and whatever they are called! When
> > I try to connect to windows update the system slows down and perhaps after 10
> > minutes I "get through" and Windows Update checks my computer. Then I receive
> > an error message > cannot update. The process wuauclt.exe runs constantly
> > form startup and steals 50% CPU. When I try to shut down the process it just
> > restarts again. Trying to shut down the process via cmd does not function
> > either > get the message: the process cannot be stopped. This is the latest
> > registry in the windows update log file:
> > 2007-05-29 17:47:51:265 3768 970 Misc = Process:
> > C:\WINDOWS\system32\wuauclt.exe
> > 2007-05-29 17:47:51:265 3768 970 AUClnt FATAL: Error: 0xc8000408. wuauclt
> > datastore: failed to spawn COM server
> > 2007-05-29 17:47:51:375 780 d38 DtaStor FATAL: DS: Out of proc datastore
> > process exited with error 0xc8000408 before signalling ready event.
> >
> > Anyone?
>

[good luck, bromow]

"Bjoern" <> wrote in message

> Well, i thougt it was a problem with wuauclt.exe because i did not have
> the
> latest updates from Windows Update. I have them now, after manual
> installation. That was what i meant with "fixes and pathes and so on"...>
> bad
> english I guess! Anyway; i have rebooted to safe mode and checked full
> access
> for "SYSTEM" under the security tab. It was allready set to full
> access....
> so ive still got the problem. Thank you anyway for your reply and
> suggestion.
>
> "MowGreen [MVP]" wrote:
>
>> XP Pro - *right* click C:\ (or the *root drive*), choose Properties,
>> Security
>> Add System with Full Control
>> XP HomeEdition - boot to Safe Mode to access the Security tab by logging
>> on as Admin
>>
>> Specifically, what 'fixes and patches and whatever they are called' were
>> installed ?
>>
>>
>> MowGreen [MVP 2003-2007]
>> ===============
>> *-343-* FDNY
>> Never Forgotten
>> ===============
>>
>>
>> Bjoern wrote:
>>
>>> Hi; i have tried several fixes and patches and whatever they are
>>> called! When
>>> I try to connect to windows update the system slows down and perhaps
>>> after 10
>>> minutes I "get through" and Windows Update checks my computer. Then I
>>> receive
>>> an error message > cannot update. The process wuauclt.exe runs
>>> constantly
>>> form startup and steals 50% CPU. When I try to shut down the process it
>>> just
>>> restarts again. Trying to shut down the process via cmd does not
>>> function
>>> either > get the message: the process cannot be stopped. This is the
>>> latest
>>> registry in the windows update log file:
>>> 2007-05-29 17:47:51:265 3768 970 Misc = Process:
>>> C:\WINDOWS\system32\wuauclt.exe
>>> 2007-05-29 17:47:51:265 3768 970 AUClnt FATAL: Error: 0xc8000408.
>>> wuauclt
>>> datastore: failed to spawn COM server
>>> 2007-05-29 17:47:51:375 780 d38 DtaStor FATAL: DS: Out of proc
>>> datastore
>>> process exited with error 0xc8000408 before signalling ready event.
>>>
>>> Anyone?

I am using Windows Update. Using "net stop wuaserv" does not stop the
wuauclt.exe process from running. Shouldnt it? Anyways; I have followed your
steps, after turning off Trend Micro Pc Cillin and Windows Defender (who
doesnt gain any updates either...). Under "step 2" I had to run the installer
manually because I got the message "...allready installed". After some time I
got installation failure with the code 0x8007041d....

"Robin Walker [MVP]" wrote:

> Bjoern <> wrote:
>
> > Hi; i have tried several fixes and patches and whatever they are
> > called! When I try to connect to windows update the system slows down
> > and perhaps after 10 minutes I "get through" and Windows Update
> > checks my computer. Then I receive an error message > cannot update.
> > The process wuauclt.exe runs constantly form startup and steals 50%
> > CPU. When I try to shut down the process it just restarts again.
> > Trying to shut down the process via cmd does not function either >
> > get the message: the process cannot be stopped.
>
> Although your description does not match the usual symptoms, it would be
> worth upgrading to the latest versions of Windows Update, and then checking
> for any symptoms remaining after that, in case the issue is now fixed.
> Could you also confirm whether you are trying to use "Windows Update" or
> "Microsoft Update", as stated in the heading of the update web page.
>
> Before doing the items below, ensure that you have disabled all 3rd-party
> anti-virus, anti-spyware, popup-blocker, download accelerator, or firewall.
> If you disabled a 3rd-party firewall, then re-enable Windows Firewall for
> the duration.
>
> You might need to stop Automatic Updates while you apply these two fixes:
> open a command prompt window and type the command:
>
> net stop wuauserv
>
> For a fix to the above problem, please do BOTH of the following:
>
> 1. (not for Vista) If your update history shows that you do not yet have
> update KB927891 installed, then download and install update KB927891 ver3:
> <http://support.microsoft.com/kb/927891>
> and then restart Windows.
>
> 2. For 32-bit systems, download and save to hard disk, and then install:
> <http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe>
>
> If this produces an error message about "Update agent already
> installed", then execute the installer again manually, with parameter
> /wuforce as in (at a comand prompt window):
>
> WindowsUpdateAgent30-x86.exe /wuforce
>
> Then visit Microsoft Update again, and report back whether your problem is
> fixed.
>
> --
> Robin Walker [MVP Networking]
>
>
>
>

This could perhaps be a challenge for you guys (or girls for that matter) due
to my lack of good english... The problem is:

1)wuauclt.exe is running constantly using approx 50% CPU
2)Connection to Windows Update is very slow. After a while I get the error
code: 0x80248011.
3)Less important: Windows Defender is neither able to gain updates. I have
installed the latest version.

After the last attempt to use windows update, I have this from the logfile.
(Somewhat different from my first post...):

2007-05-29 23:56:26:859 3188 97c Misc =========== Logging initialized
(build: 7.0.6000.374, tz: +0200) ===========
2007-05-29 23:56:26:859 3188 97c Misc = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-05-29 23:56:26:859 3188 97c Misc = Module:
C:\WINDOWS\system32\wuaueng.dll
2007-05-29 23:56:26:859 3188 97c DtaStor FATAL: Failed to initialize
datastore, error = 0xC8000408
2007-05-29 23:56:26:859 3188 97c Misc =========== Logging initialized
(build: 7.0.6000.374, tz: +0200) ===========
2007-05-29 23:56:26:859 3188 97c Misc = Process:
C:\WINDOWS\system32\wuauclt.exe
2007-05-29 23:56:26:859 3188 97c AUClnt FATAL: Error: 0xc8000408. wuauclt
datastore: failed to spawn COM server
2007-05-29 23:56:26:875 788 76c DtaStor FATAL: DS: Out of proc datastore
process exited with error 0xc8000408 before signalling ready event.
2007-05-29 23:56:26:875 788 76c Agent * WARNING: Exit code = 0x80248011
2007-05-29 23:56:26:875 788 76c Agent *********
2007-05-29 23:56:26:875 788 76c Agent ** END ** Agent: Finding updates
[CallerId = WindowsUpdate]
2007-05-29 23:56:26:875 788 76c Agent *************
2007-05-29 23:56:26:875 788 76c Agent WARNING: WU client failed Searching
for update with error 0x80248011
2007-05-29 23:56:26:890 604 d00 COMAPI >>-- RESUMED -- COMAPI: Search
[ClientId = WindowsUpdate]
2007-05-29 23:56:26:890 604 d00 COMAPI - Updates found = 0
2007-05-29 23:56:26:890 604 d00 COMAPI - WARNING: Exit code = 0x00000000,
Result code = 0x80248011
2007-05-29 23:56:26:890 604 d00 COMAPI ---------
2007-05-29 23:56:26:890 604 d00 COMAPI -- END -- COMAPI: Search
[ClientId = WindowsUpdate]
2007-05-29 23:56:26:890 604 d00 COMAPI -------------
2007-05-29 23:56:26:890 604 564 COMAPI WARNING: Operation failed due to
earlier error, hr=80248011
2007-05-29 23:56:26:890 604 564 COMAPI FATAL: Unable to complete
asynchronous search. (hr=80248011)
2007-05-29 23:56:31:890 788 76c Report REPORT EVENT:
{A09C15CF-C615-4F1B-9E7F-054A008A8E9C} 2007-05-29
23:56:26:875+0200 1 148 101 {00000000-0000-0000-0000-000000000000} 0 80248011 WindowsUpdate Failure Software
Synchronization Windows Update Client failed to detect with error 0x80248011.


"Bjoern" wrote:

> I am using Windows Update. Using "net stop wuaserv" does not stop the
> wuauclt.exe process from running. Shouldnt it? Anyways; I have followed your
> steps, after turning off Trend Micro Pc Cillin and Windows Defender (who
> doesnt gain any updates either...). Under "step 2" I had to run the installer
> manually because I got the message "...allready installed". After some time I
> got installation failure with the code 0x8007041d....
>
> "Robin Walker [MVP]" wrote:
>
> > Bjoern <> wrote:
> >
> > > Hi; i have tried several fixes and patches and whatever they are
> > > called! When I try to connect to windows update the system slows down
> > > and perhaps after 10 minutes I "get through" and Windows Update
> > > checks my computer. Then I receive an error message > cannot update.
> > > The process wuauclt.exe runs constantly form startup and steals 50%
> > > CPU. When I try to shut down the process it just restarts again.
> > > Trying to shut down the process via cmd does not function either >
> > > get the message: the process cannot be stopped.
> >
> > Although your description does not match the usual symptoms, it would be
> > worth upgrading to the latest versions of Windows Update, and then checking
> > for any symptoms remaining after that, in case the issue is now fixed.
> > Could you also confirm whether you are trying to use "Windows Update" or
> > "Microsoft Update", as stated in the heading of the update web page.
> >
> > Before doing the items below, ensure that you have disabled all 3rd-party
> > anti-virus, anti-spyware, popup-blocker, download accelerator, or firewall.
> > If you disabled a 3rd-party firewall, then re-enable Windows Firewall for
> > the duration.
> >
> > You might need to stop Automatic Updates while you apply these two fixes:
> > open a command prompt window and type the command:
> >
> > net stop wuauserv
> >
> > For a fix to the above problem, please do BOTH of the following:
> >
> > 1. (not for Vista) If your update history shows that you do not yet have
> > update KB927891 installed, then download and install update KB927891 ver3:
> > <http://support.microsoft.com/kb/927891>
> > and then restart Windows.
> >
> > 2. For 32-bit systems, download and save to hard disk, and then install:
> > <http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe>
> >
> > If this produces an error message about "Update agent already
> > installed", then execute the installer again manually, with parameter
> > /wuforce as in (at a comand prompt window):
> >
> > WindowsUpdateAgent30-x86.exe /wuforce
> >
> > Then visit Microsoft Update again, and report back whether your problem is
> > fixed.
> >
> > --
> > Robin Walker [MVP Networking]
> >
> >
> >
> >

0x8007041d The service did not respond to the start or control request
in a timely fashion

Open the Services console by going to Start > Run > type in

services.msc
Click OK or press Enter

Locate Automatic Updates.
Double click *on* it
The Startup type must be set to Automatic
If the service is stopped then click the Start button

Now locate Background Intelligent Transfer Service
Double click *on* it
The Startup type can be set to Manual or Automatic
It CAN NOT be set to Disabled or the system will not update
If the service is stoppend then click the Start button

The error message is most likely in regards to you having stopped
Automatic Updates by running net stop wuauserv
Restart the service via the Services console
Now try to install WindowsUpdateAgent30-x86.exe

In a previous post you stated:

> i have rebooted to safe mode and checked full access
> for "SYSTEM" under the security tab. It was allready set to full access.

These are the boxes that need to be checked for System under Allow:

Full Control
Modify
Read & Execute
List Folder Contents
Read
Write


MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============



Bjoern wrote:

> I am using Windows Update. Using "net stop wuaserv" does not stop the
> wuauclt.exe process from running. Shouldnt it? Anyways; I have followed your
> steps, after turning off Trend Micro Pc Cillin and Windows Defender (who
> doesnt gain any updates either...). Under "step 2" I had to run the installer
> manually because I got the message "...allready installed". After some time I
> got installation failure with the code 0x8007041d....
>
> "Robin Walker [MVP]" wrote:
>
>
>>Bjoern <> wrote:
>>
>>
>>>Hi; i have tried several fixes and patches and whatever they are
>>>called! When I try to connect to windows update the system slows down
>>>and perhaps after 10 minutes I "get through" and Windows Update
>>>checks my computer. Then I receive an error message > cannot update.
>>>The process wuauclt.exe runs constantly form startup and steals 50%
>>>CPU. When I try to shut down the process it just restarts again.
>>>Trying to shut down the process via cmd does not function either >
>>>get the message: the process cannot be stopped.
>>
>>Although your description does not match the usual symptoms, it would be
>>worth upgrading to the latest versions of Windows Update, and then checking
>>for any symptoms remaining after that, in case the issue is now fixed.
>>Could you also confirm whether you are trying to use "Windows Update" or
>>"Microsoft Update", as stated in the heading of the update web page.
>>
>>Before doing the items below, ensure that you have disabled all 3rd-party
>>anti-virus, anti-spyware, popup-blocker, download accelerator, or firewall.
>>If you disabled a 3rd-party firewall, then re-enable Windows Firewall for
>>the duration.
>>
>>You might need to stop Automatic Updates while you apply these two fixes:
>>open a command prompt window and type the command:
>>
>>net stop wuauserv
>>
>>For a fix to the above problem, please do BOTH of the following:
>>
>>1. (not for Vista) If your update history shows that you do not yet have
>>update KB927891 installed, then download and install update KB927891 ver3:
>><http://support.microsoft.com/kb/927891>
>>and then restart Windows.
>>
>>2. For 32-bit systems, download and save to hard disk, and then install:
>><http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe>
>>
>>If this produces an error message about "Update agent already
>>installed", then execute the installer again manually, with parameter
>>/wuforce as in (at a comand prompt window):
>>
>>WindowsUpdateAgent30-x86.exe /wuforce
>>
>>Then visit Microsoft Update again, and report back whether your problem is
>>fixed.
>>
>>--
>>Robin Walker [MVP Networking]
>>
>>
>>
>>

Bjoern <> wrote:

> 1)wuauclt.exe is running constantly using approx 50% CPU
> 2)Connection to Windows Update is very slow. After a while I get the
> error code: 0x80248011.
> 3)Less important: Windows Defender is neither able to gain updates. I
> have installed the latest version.

Please confirm the version number and last-modified date of these files:

C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msi.dll

Please search the system for any other file named wuauclt.exe in a different
directory (for instance, c:\WINDOWS\TEMP)which might be a trojan. There
have been previous reports of high CPU usage in wuauclt.exe - and they have
been trojans with the same name as the automatic update client.

Also check in msconfig to see if wuauclt.exe is being launched at every
boot - if so it is definitely a trojan. The real wuauclt.exe does not get
launched as a Run item.

--
Robin Walker [MVP Networking]

I have the following:

C:\WINDOWS\system32\wuauclt.exe: version number 7.0.6000.374, last modified
16. april 2007

C:\WINDOWS\system32\msi.dll: version number 3.1.4000.4039, last modified 18.
april 2007

Searching for wuauclt.exe on my computer gave 2 hits: in c:\windows\system32
and c:\windows\system32\dllcache

In msconfig there is no wuauclt.exe incident under start up. Howewer I have
one entry here with no name, it launches as a run item. Only the marked
checkbox shows for this incident. No text.

No trojan then I guess...?

Bjoern


"Robin Walker [MVP]" wrote:

> Bjoern <> wrote:
>
> > 1)wuauclt.exe is running constantly using approx 50% CPU
> > 2)Connection to Windows Update is very slow. After a while I get the
> > error code: 0x80248011.
> > 3)Less important: Windows Defender is neither able to gain updates. I
> > have installed the latest version.
>
> Please confirm the version number and last-modified date of these files:
>
> C:\WINDOWS\system32\wuauclt.exe
> C:\WINDOWS\system32\msi.dll
>
> Please search the system for any other file named wuauclt.exe in a different
> directory (for instance, c:\WINDOWS\TEMP)which might be a trojan. There
> have been previous reports of high CPU usage in wuauclt.exe - and they have
> been trojans with the same name as the automatic update client.
>
> Also check in msconfig to see if wuauclt.exe is being launched at every
> boot - if so it is definitely a trojan. The real wuauclt.exe does not get
> launched as a Run item.
>
> --
> Robin Walker [MVP Networking]
>
>
>
>