Need help with results of Process Explorer

[sorcerer]

Is there some known issue floating around at the moment, such as a bad Windows Update or something? I've got three separate laptops in (2 Acers and an Asus, all running Windows 7 HP SP1) that are all running slowly because of something hogging the CPU. In each case, the CPU useage is almost constantly between 90 and 100% (except, of course, for that nanosecond when I chose to hit the 'Print Screen' button for the example image below ) and in every case it's Svchost Netsvc wuauserv that seems to me to be the culprit.

My problem is that I've never used Process Explorer before and I've not really got any idea what it's telling me or how I go about fixing the problem, hence my hope that it's a currently common issue that someone can perhaps point to a known fix for it.

 

[coffee]

svchost.exe is pretty common to get infected. Have you run a good virus scan?

 

[YeOldeStonecat]

How much RAM on those laptops?
If it's an under-RAM'd machine...like just 4 gigs of RAM...or...forbid...something painful like 2 gigs or...shoot me now..just 1 gig...you'll see Microsoft update just kill the computer for a few days straight until she's caught up.

Some computers come in with not enough RAM, we'll install more RAM, ends up saving the client tons of money...cuz the updates can get done within reasonable time. Instead of taking a few days.

 

[gadgetfixup]

That's exactly what happens when Windows updates are far behind or broken. Reboot in Safe Mode, run Tweakings AIO to try and repair the update service. If you still have issues, run the wsusoffline updater to fill in those updates. Once the updates are caught up your WUA will drop back to normal or disappear.

 

[sorcerer]

svchost.exe is pretty common to get infected. Have you run a good virus scan?

Yeah, I've run HitmanPro, MBAM, ADWCleaner, Rogue Killer and Junkware Removal Tool myself and found a couple of PUPs but nothing untoward, plus each machine has already got either Kaspersky or Panda installed by their owners and they didn't find anything.

Thanks Coffee

 

[sorcerer]

Stonecat and inbargains - thanks guys. Not sure about the amount of RAM but will do as you suggest re the Updates.

Cheers

 

[gadgetfixup]

Yeah we've seen that dozens of times in recent weeks. WUA when you first boot is relatively normal and then it just starts climbing and will climb until the machine is crippled. Once you get those updates installed, it will fix itself.

 

[glricht]

What you're describing is also a common symptom of a Poweliks infection. It was a real common about a year or so ago, but sort of died out. However, I got a PC in just two weeks ago that had it. Take a look http://www.eset.com/my/download/uti...&attr=6146990&pub=10921755&shop=1r3f0v3cpbavv

 

[BrandonTech]

We had this problem in our school environment in the past. It was supposedly due to a bug in the Windows Update Client. Something about a memory leak that it caused which prevented it from playing fair with the RAM installed in the machine...so in essence it would take it all no matter if you had 2 GB or 8 GB (though our machines were topping out around 4 GB). I would sea svchost with wuauser taking up 2 GB alone.

There were hotfixes release. Pretty sure it this was one...

https://support.microsoft.com/en-us/kb/3050265

I don't think that particular one has been superseded, and if it had I would assume it would tell me on that page.

This page may also be helpful after you try that as the latest version of Windows Update Client shouldn't be having that issue...

https://support.microsoft.com/en-us/kb/949104

I hope this helps, and good luck to you in getting it sorted out.

 

[glennd]

This page may also be helpful after you try that as the latest version of Windows Update Client shouldn't be having that issue...

https://support.microsoft.com/en-us/kb/949104

I guess that didn't work out so well, it's dated 12/24/2014.

 

[FremontPC]

I ran into this recently, I installed this WU client:
https://support.microsoft.com/en-us/kb/3065987

EDIT:
*****************************************************
Looks like there's a newer one yet:

https://support.microsoft.com/en-us/kb/3138612
******************************************************

then I ran SURT.

Be patient, it will take some time to sort itself. Hopefully it will be tons quicker than it was on the AMD V120 single core that I had to fix...

 

[glennd]

Kinda reminds me of that golfer last week who, inches from the hole, just could not get the ball to go in...

 

[ZenTree]

There were hotfixes release. Pretty sure it this was one...

https://support.microsoft.com/en-us/kb/3050265

.

Yup that's the one. Although we still experienced some computers struggling after. This looks like a classic case of the windows update blues and since you've already run quite a few scans i'd stick to the update issue as a simple likely issue rather than chasing down rogue infections just yet. WSUSoffline is the only way we've found to deal with some of these but seems to be better afterwards.

 

[Mick]

On the subject of interpreting Process Explorer, does anyone happen to know of an on-line list of PIDs? Usually, I just Google whichever one I want to know about, but that's a bit hit and miss.

 

[TurricanII]

On the subject of interpreting Process Explorer, does anyone happen to know of an on-line list of PIDs? Usually, I just Google whichever one I want to know about, but that's a bit hit and miss.

The PID is a dynamic number for the process. System gets PID 4 however, but I am not aware of any other items with a constant PID. Process Explorer is the best bet to tell you what services are registered under each svchost.exe

 

[kpk1]

I often find that update stops working when it has large batches of updates to go through and it need a reboot every now and then to install some before it'll work again.
No prompts to reboot, nothing.
Same old, same old.

Sent from my A0001 using Tapatalk

 

[Mick]

The PID is a dynamic number for the process. System gets PID 4 however, but I am not aware of any other items with a constant PID.

Thanks - I didn't know that.