Processes in Task Manager during updates

[Kayla77]

Forgive me if this is a stupid question.

One of my laptops is running Vista Home Premium SP2 64-bit.

I decided after the last update in March to disable them altogether and check them once a month myself. It's been exactly two months. Everything is hanging, this didn't happen in March.

My question is what are the processes in Task Manager that are supposed to appear during updates. I tried to update earlier today but given that I have only 2GB of RAM and the svchost.exe related to wuauserv was using over half of it at one point, I used command prompt to quit because my system was becoming unresponsive. That didn't go well. I ended up having to shut down improperly and got a temporary profile message. I restarted twice and my old profile is back so I decided to give the updates another try.

My current attempt to do updates began at 3:20 pm and it's now 7:20 pm. It was using a lot of memory at first but not 1GB and 50% cpu. Thankfully, after an hour or so, the memory usage went to normal but the 50% cpu usage remains. It is wuauserv in the services tab (one of the highlighted ones) but I was under the impression that there should be a process for windows update showing up in the Task Manager as well. But, I see none.

The wuauserv service is running. Windows Update shows it checking for updates (4+ hours). Is this waiting all for naught? Shouldn't I see something regarding the update in the processes list? Perhaps, something was corrupted and this wait will be eternal.

Any help would be greatly appreciated. I'm backing up my files right now while Windows continues to check for updates.

ETA: After more than five hours, the downloading of actual updates (19 in total) began and that was very fast.. Currently, update 1 of 19 is installing, this part is slow. Hopefully, updates will be installed successfully.

 

[lmacri]

...My question is what are the processes in Task Manager that are supposed to appear during updates. I tried to update earlier today but given that I have only 2GB of RAM and the svchost.exe related to wuauserv was using over half of it at one point, I used command prompt to quit because my system was becoming unresponsive...

My current attempt to do updates began at 3:20 pm and it's now 7:20 pm. It was using a lot of memory at first but not 1GB and 50% cpu. Thankfully, after an hour or so, the memory usage went to normal but the 50% cpu usage remains. It is wuauserv in the services tab...

Hi Kayla77:

If the initial "Checking for updates..." phase of your Windows Updates run for long periods of time without throwing an error message, this is a common problem that currently affects many Win 7 and Vista users. On my 32-bit Vista system, I see constant consumption of ~ 50% of my CPU by the Windows Update service (wuauserv) running under the svchost.exe process (i.e., complete saturation of one of my dual cores) during the "Checking for updates.." phase of my Patch Tuesday updates. My problem started in Aug 2015 - one month after the official release of Win 10 - and I sometimes have to wait 4 to 5 hours before "Checking for updates..." reports that updates are available for download.

This problem is being discussed in ScousaJAY's thread windows update just seems to hang while checking. Most users in that thread are simply turning off automatic Windows Updates, starting a manual Windows Update, and just leaving their computer alone for several hours until "Checking for updates..." reports that updates are available for download.

My post # 149 in ScousaJAY's thread includes an image of typical CPU consumption during my Patch Tuesday Updates. Post # 150 includes a possible workaround (i.e., installation of Windows kernel-mode driver Win32k.sys updates from the Microsoft Download Center before running Windows Update) to speed up the "Checking for updates..." phase. I haven't had a chance to test this workaround but other Vista users are reporting that this workaround significantly improved the speed of their April and May 2016 Patch Tuesday updates.
------------
32-bit Vista Home Premium SP2 * Firefox v46.0.1 * NIS v21.7.0.11 * MBAM Premium v2.2.1

 

[Kayla77]

Thanks for responding.

I had edited my post to indicate that after 5 hours, the status had finally changed although it's taking a long time to install the first of nineteen updates.

I did read some of those threads and posted in one of them.

Perhaps it was on another OS but there was a process other than svchost.exe that involved windows updates. I thought other errors might have contributed to the stalling but obviously I was mistaken.

I will keep my updates to manual since this is likely to remain a problem in the future. Thanks for the links.

I am buying a new PC this year after upgrading my iMac last summer. I doubt windows updates will cease to plague me though...... thank again.

 

[lmacri]

Perhaps it was on another OS but there was a process other than svchost.exe that involved windows updates. I thought other errors might have contributed to the stalling but obviously I was mistaken.

Hi Kayla77:

Glad to hear your updates finally installed. If anyone finds a permanent solution (or Microsoft finally takes pity on Vista users and releases a patch for the Windows Update Agent) it will likely be shared in ScousaJAY's thread windows update just seems to hang while checking where you posted.

There are various processes that consume CPU during the different phases of a Windows Update session. You might be thinking of the Windows Modules Installer (TrustedInstaller.exe) that consumes most of the CPU during the installation phase, as shown in the screenshot below from my March 2016 Patch Tuesday Update. If you normally download the monthly update for the Windows Malicious Software Removal Tool (KB890830) on Patch Tuesdays, you'll also notice the mrt.exe process consuming high amounts of CPU during the automated malware scan.



The svchost.exe process is just a generic executable process that "hosts" (contains) various Windows services. It's not unusual to see multiple instances of svchost.exe listed in Task Manager because all sorts of programs like Windows Update, Windows Defender, Windows Disk Defragmenter, etc. use svchost.exe to run services in their dynamic link libraries (.DLL files). The Windows Update service (wuauserv) that runs during the initial "Checking for updates..." phase is just one example of a service that runs under the svchost.exe process.
------------
32-bit Vista Home Premium SP2 * Firefox v46.0.1 * NIS v21.7.0.11 * MBAM Premium v2.2.1

 

[townsbg]

Imacri is correct. The windows update service runs using svchost.exe You can tell this by opening up services.msc, finding and double clicking on windows update you will then see

Path to executable:
C:\Windows\system32\svchost.exe -k netsvcs

Many system services use that application. Why they did that is beyond me. If you ever want to or need to know which service is using which you can use process explorer. It provides a lot more information than Windows task manager.

 

[lmacri]

If you ever want to or need to know which service is using which you can use process explorer.

Hi Kayla77:

Further to townsbg's post, here's a screenshot from my April 2016 Patch Tuesday updates using Sysinternal's Process Explorer. During my "Checking for updates..." phase I ran Process Explorer, sorted my CPU column from highest to lowest, right-clicked the svchost.exe process, and chose Properties from the context menu. The Threads tab of the pop-up showed that the entire ~50% of my CPU was consumed by the Windows Update service (wuauserv), and more specifically by a thread for the Windows Update Agent (wuaueng.dll). Process Explorer doesn't have to be installed on your computer - just unzip the downloaded ProcessExplorer.zip file and run procexp.exe to launch the utility.



The Windows Update Agent (WUA) at C:\Windows\system32\wuaueng.dll on my 32-bit Vista system is currently v7.6.7600.256 and hasn't been updated since June 2012. Win 7 isn't immune to these slow Windows Updates, but Win 7 has received several WUA updates since 2012, including patch KB3050265 (Windows Update Client for Windows 7: June 2015) which reads in part:"This update addresses an issue in which system performance can be decreased during scans. This issue has the greatest effect on computers that have a small amount of physical memory." I've never seen a similar WUA patch for Vista that improves the performance of Windows Update on computers with a small amount of RAM.

The How-To Geek article What is svchost.exe and Why is it Running? includes a brief discussion on why Microsoft started moving Windows functionality away from .EXE executables in favour of .DLL dynamic link libraries like the Windows Update Agent wuaueng.dll.
------------
32-bit Vista Home Premium SP2 * Firefox v46.0.1 * NIS v21.7.0.11 * MBAM Premium v2.2.1

 

[Kayla77]

Thanks for the information. It's a lot but it's always better to be more informed.

18/19 updates were successfully installed so I'm delighted about that. I will attempt that failed one again at a later time.

 

[LMiller7]

Imacri is correct. The windows update service runs using svchost.exe You can tell this by opening up services.msc, finding and double clicking on windows update you will then see

Many system services use that application. Why they did that is beyond me. If you ever want to or need to know which service is using which you can use process explorer. It provides a lot more information than Windows task manager.

Each instance of svchost.exe hosts one or more system services. This is more efficient in terms of resource usage than each service requiring it's own process. Processes have considerably more overhead then threads. It also facilitates sharing of code and data between services.

Having multiple instances of svchost.exe allows each one to run under different accounts with different rights. This follows the principle that services have only the rights needed to do their job, thereby enhancing security. It also enhances system stability. Some instances of svchost.exe can potentially run third party code. If all services were running under the same instance a problem in one service could bring down the entire system. With the current implementation likely only those services of the effected svchost.exe instance would be effected.