wuaudt.exe - it is taking over my system

This is a component of MS Windows AutoUpdate Client. This process
continuously checks the Microsoft Windows Update website for updates to be
installed on your operating system. However it is killing me. I'm running
WinXP Pro (with all the updates) on an IBM T43p with 2GB of real memory and
tons of free HD space (currently I have 50GB free). When I boot my system
sometimes it is 20 minutes before I can use it (I'm in the process of a new
HD rebuild), wuaudt seems to be doing its thing. In the taskmgr sometimes it
shows that the system is 90%+ idle (when I click on something nothing happens
for several minutes) and other times I see scvhost consuming my system. When
I use "Process Viewer" and track down the PID for scvhost I find
"C:\WINDOWS\System32\svchost.exe -k netsvsc" as the app executed for svchost.
Then when I look at process tree I see wuaudt.exe at the top of the list for
svchost.

Also when I look in the taskmgr I see two entries for wuaudt.exe - good
grief how many times does this darn thing need to run at the same time?

My antivirus (latest zone alarm) is not complaining about anything and I
have the latest updates and I've scanned my system. This is not to say I
don't have a virus but it does not seem reasonable.

Also I'm running Diskeeper and I've looked at what it is doing. It normally
runs when the activity on my PC is very low or has stopped. I run my laptop
24x7 so diskeeper has lots of idle time to do what it should. I've checked
and it will stop when I start using the PC, thus I don't feel this is the app
at fault.

Any suggestions?

The wuauclt.exe file is located in the folder C:\Windows\System32 (Windows Update
AutoUpdate Client).

In other cases, wuauclt.exe is a virus, spyware, trojan or worm!
see:
http://www.sophos.com/security/analyses/trojcultb.html

--

====================================
TaurArian [MS-MVP] 2005-2007 - Australia
====================================
How to make a good post: http://www.dts-l.org/goodpost.htm
Backup and data recovery: http://www.acronis.com.sg/
Enhancing file system performance: http://www.diskeeper.com/defrag.asp


"JGT" <> wrote in message
news:FF3C895F-8624-411D-9434-...
| This is a component of MS Windows AutoUpdate Client. This process
| continuously checks the Microsoft Windows Update website for updates to be
| installed on your operating system. However it is killing me. I'm running
| WinXP Pro (with all the updates) on an IBM T43p with 2GB of real memory and
| tons of free HD space (currently I have 50GB free). When I boot my system
| sometimes it is 20 minutes before I can use it (I'm in the process of a new
| HD rebuild), wuaudt seems to be doing its thing. In the taskmgr sometimes it
| shows that the system is 90%+ idle (when I click on something nothing happens
| for several minutes) and other times I see scvhost consuming my system. When
| I use "Process Viewer" and track down the PID for scvhost I find
| "C:\WINDOWS\System32\svchost.exe -k netsvsc" as the app executed for svchost.
| Then when I look at process tree I see wuaudt.exe at the top of the list for
| svchost.
|
| Also when I look in the taskmgr I see two entries for wuaudt.exe - good
| grief how many times does this darn thing need to run at the same time?
|
| My antivirus (latest zone alarm) is not complaining about anything and I
| have the latest updates and I've scanned my system. This is not to say I
| don't have a virus but it does not seem reasonable.
|
| Also I'm running Diskeeper and I've looked at what it is doing. It normally
| runs when the activity on my PC is very low or has stopped. I run my laptop
| 24x7 so diskeeper has lots of idle time to do what it should. I've checked
| and it will stop when I start using the PC, thus I don't feel this is the app
| at fault.
|
| Any suggestions?

I'm running WSUS and a growing number of our client PCs are exhibiting the
99% CPU utilization for svchost. The kb927891 patch slightly alleviated, but
did not fix the issue on the XP PCs I installed it on.
M$ needs to correct this problem.

"JGT" wrote:

> This is a component of MS Windows AutoUpdate Client. This process
> continuously checks the Microsoft Windows Update website for updates to be
> installed on your operating system. However it is killing me. I'm running
> WinXP Pro (with all the updates) on an IBM T43p with 2GB of real memory and
> tons of free HD space (currently I have 50GB free). When I boot my system
> sometimes it is 20 minutes before I can use it (I'm in the process of a new
> HD rebuild), wuaudt seems to be doing its thing. In the taskmgr sometimes it
> shows that the system is 90%+ idle (when I click on something nothing happens
> for several minutes) and other times I see scvhost consuming my system. When
> I use "Process Viewer" and track down the PID for scvhost I find
> "C:\WINDOWS\System32\svchost.exe -k netsvsc" as the app executed for svchost.
> Then when I look at process tree I see wuaudt.exe at the top of the list for
> svchost.
>
> Also when I look in the taskmgr I see two entries for wuaudt.exe - good
> grief how many times does this darn thing need to run at the same time?
>
> My antivirus (latest zone alarm) is not complaining about anything and I
> have the latest updates and I've scanned my system. This is not to say I
> don't have a virus but it does not seem reasonable.
>
> Also I'm running Diskeeper and I've looked at what it is doing. It normally
> runs when the activity on my PC is very low or has stopped. I run my laptop
> 24x7 so diskeeper has lots of idle time to do what it should. I've checked
> and it will stop when I start using the PC, thus I don't feel this is the app
> at fault.
>
> Any suggestions?

My issue is with wuaudt not wuauclt - the font on my PC makes the "dt", e,g,
d t look like c l t (I put spaces to help make it clear).

"TaurArian [MS-MVP]" wrote:

> The wuauclt.exe file is located in the folder C:\Windows\System32 (Windows Update
> AutoUpdate Client).
>
> In other cases, wuauclt.exe is a virus, spyware, trojan or worm!
> see:
> http://www.sophos.com/security/analyses/trojcultb.html
>
> --
>
> ====================================
> TaurArian [MS-MVP] 2005-2007 - Australia
> ====================================
> How to make a good post: http://www.dts-l.org/goodpost.htm
> Backup and data recovery: http://www.acronis.com.sg/
> Enhancing file system performance: http://www.diskeeper.com/defrag.asp

Opt out of MU update and use only WU.
Manually scan for Office updates when required.
See if that helps.



"JGT" wrote:

> My issue is with wuaudt not wuauclt - the font on my PC makes the "dt", e,g,
> d t look like c l t (I put spaces to help make it clear).
>
> "TaurArian [MS-MVP]" wrote:
>
> > The wuauclt.exe file is located in the folder C:\Windows\System32 (Windows Update
> > AutoUpdate Client).
> >
> > In other cases, wuauclt.exe is a virus, spyware, trojan or worm!
> > see:
> > http://www.sophos.com/security/analyses/trojcultb.html
> >
> > --
> >
> > ====================================
> > TaurArian [MS-MVP] 2005-2007 - Australia
> > ====================================
> > How to make a good post: http://www.dts-l.org/goodpost.htm
> > Backup and data recovery: http://www.acronis.com.sg/
> > Enhancing file system performance: http://www.diskeeper.com/defrag.asp

I agree - I ran a quick test - before the test I checked TaskMgr and "Process
Viewer" (free download from http://www.teamcti.com/pview/prcview.htm) In the
TM I see no wuaudt.exe but I did see svchost.exe (PID 1656) where the memory,
page fault and VM size were MUCH higher than anything else. I check in
Process Viewer for svchost.exe with a PID of 1656 nothing was under it. I
then kicked off windows update, in TM svchost PID 1656 was taking a huge
portion of my system, I then check Process Viewer and under svchost PID 1656
I now see wuaudt.

For me it is not worth the performance hit to run automatically thus I'm
going to turn off auto updates and just manually check.

Thanks for your help.

"TaurArian" wrote:

> Opt out of MU update and use only WU.
> Manually scan for Office updates when required.
> See if that helps.
>
>
>
> "JGT" wrote:
>
> > My issue is with wuaudt not wuauclt - the font on my PC makes the "dt", e,g,
> > d t look like c l t (I put spaces to help make it clear).
> >
> > "TaurArian [MS-MVP]" wrote:
> >
> > > The wuauclt.exe file is located in the folder C:\Windows\System32 (Windows Update
> > > AutoUpdate Client).
> > >
> > > In other cases, wuauclt.exe is a virus, spyware, trojan or worm!
> > > see:
> > > http://www.sophos.com/security/analyses/trojcultb.html
> > >
> > > --
> > >
> > > ====================================
> > > TaurArian [MS-MVP] 2005-2007 - Australia
> > > ====================================
> > > How to make a good post: http://www.dts-l.org/goodpost.htm
> > > Backup and data recovery: http://www.acronis.com.sg/
> > > Enhancing file system performance: http://www.diskeeper.com/defrag.asp

See my other post in this thread - I'm turning off autoupdates - the
performance hit is too much for me.

"cybersaur" wrote:

> I'm running WSUS and a growing number of our client PCs are exhibiting the
> 99% CPU utilization for svchost. The kb927891 patch slightly alleviated, but
> did not fix the issue on the XP PCs I installed it on.
> M$ needs to correct this problem.
>

Maybe I could add that for those who don't want to shut it off

http://mygreenpaste.blogspot.com/200...rvices-in.html


"JGT" wrote:

> See my other post in this thread - I'm turning off autoupdates - the
> performance hit is too much for me.
>
> "cybersaur" wrote:
>
> > I'm running WSUS and a growing number of our client PCs are exhibiting the
> > 99% CPU utilization for svchost. The kb927891 patch slightly alleviated, but
> > did not fix the issue on the XP PCs I installed it on.
> > M$ needs to correct this problem.
> >

I've turned it back on. For reasons I don't understand eventhough I had
turned it off I still see wuaudt running.

"M.J." wrote:

> Maybe I could add that for those who don't want to shut it off
>
> http://mygreenpaste.blogspot.com/200...rvices-in.html

"JGT" <> wrote in message
news:034BBE68-7E17-42FB-929D-...
> I've turned it back on. For reasons I don't understand eventhough I had
> turned it off I still see wuaudt running.


I haven't been able to find any credible information to make me think
that that module name is valid (e.g. and not a Trojan.) I found one hard-to-check
suggestion that it might be valid on a Windows ME system and in any case
ZERO references on site:microsoft.com. Most of the reports I found about
it I would write off as either confusion caused by misreading and subsequent
transcription errors or obscure reports which just as easily could be inadvertent
disclosure of the presence of a Trojan.

So, do you have wuauclt.exe too? What are the properties of both modules?


---