WUDFHost.exe constantly on 12-20% CPU

OK, this is actually my own answer to an unwritten question on this title problem chasen today ...

Why there is WUDFHost.exe constantly on some 12-20% CPU?

According to several posts on the net "The WUDFHost.exe process is part of Windows Driver Foundation of Microsoft", and an essential one, if found on %WinDir%\System32 folder. It is pointed to be taking care of "User-mode Drivers".

After checking the drivers on this about half-year old laptop, first 3 most critical ones manually and also updating them, I didn't still note any change on the CPU list. Then I went on checking others automatically this time with the Free Driver Booster 3, and it found some 12 more drivers outdated. So, now I let twice some 3-4 "easy" ones get updated automatically by DB3 and there between checked the actual CPU list, but still no change. But, after an automatic DB3 update of the last "critical/difficult" 5 m/b drivers the WUDFHost.exe was on 0% CPU, great! Note also, that all of the updated 15 drivers were just 3-12 months old.

Edit 18.08.2016 10:30 (GMT+3):

Sorry, to inform, but this cure was a short joy, after Windows 10 was Upgraded from 1511 to 1607 the problem did return, i.e. back to 15-17% CPU, and now the DB3 did recognise only up-to-date drivers ... See below my comments on this.

Edit 18.08.2016 12:30 (GMT+3):

OK, the new troublemaker identified -> Lenovo Quick Optimizer, see below my comment on it, and now this case hopefully finally cleared.

PeteVfi

Posted 2016-08-17T14:31:34.507

Reputation: 223

Install the WPT (part of the Win10 SDK: https://dev.windows.com/en-us/downloads/windows-10-sdk), run WPRUI.exe, select "First Level", under Resource select CPU usage and click on start. Now capture 1 minute of the CPU usage. After 1 minute click on Save. Zip the large ETL file (+ NGENPDB folder) into 1 zip, upload the zip (OneDrive, dropbox, google drive) and post the share link here.

– magicandre1981 – 2016-08-17T15:52:24.693

@magicandre1981 OK, thanks for the instructions. Now I did the CPU recording with WPR and checked it with WPA, and, ooops ... now the WUDFHost.exe proved to be once again at the 15% level, a few hours ago it was long time at 0% only, as described above ... But, what happened now there between, Windows 10 Upgrade from 1511 to1607 was performed with restart etc.! Now I shall take a break with this, and will come back with a new report first thing on the morning. – PeteVfi – 2016-08-17T17:00:46.280

Sorry, checked once again the status of the WUDFHost.exe on this particular quite new laptop, and as now it is back on the 15-17% CPU level, I have to give up digging more into the far deep in this, due to time limits, and will let it so far be as such ... So, if anyone else has interest on this case, please go on on this, and I would be grateful for some new better real cure hints or solution for this annoying problem ... – PeteVfi – 2016-08-17T22:27:25.730

share the ETL that you captured when you have the issue. Maybe I see more details – magicandre1981 – 2016-08-18T04:27:08.443

OK, please, here you have the link for the captured .zip -> https://dl.dropboxusercontent.com/u/4802168/WPR%20Files%20Lenovo.zip

– PeteVfi – 2016-08-18T07:37:15.623

OK, yippee, now the new troublemaker identified, namely -> Lenovo QuickOptimizerIcon.exe ... I stopped it, and then the problem did vanish, and rebooted for checking, and now will uninstall the program. – PeteVfi – 2016-08-18T09:18:15.140

I also posted what I see from the ETL file – magicandre1981 – 2016-08-18T15:40:53.680

Answers

Analyzing the ETL with WPA shows, that the driver iMDriver.dll causes the WUDFHost.exe cpu usage

^{(Click images to enlarge)}

Maybe this file is also part of the Lenovo Quick Optimizer. This process also causes a lot of CPU usage:

The driver and the program do IO calls via Windows Usermode Driver framework (WUDF) and this is the usage you see.

magicandre1981

Posted 2016-08-17T14:31:34.507

Reputation: 86 560

Product: Windows (R) Win 7 DDK driver Description: WUDF: iMDriver – PeteVfi – 2016-08-21T09:22:22.800

OK, yes, I checked your analysis and findings, thanks for great work. So, it's obvious, that WUDFHost.exe was servicing Lenovo Quick Optimizer on some 15-17% CPU level, and now remaining there on 0% CPU. Regarding the iMDriver.dll, I found it on \System32\drivers\UMDF noted produced by Lenovo, but, when checking on net, it's noted -> Product: Windows (R) Win 7 DDK driver Company: Windows (R) Win 7 DDK provider Description: WUDF: iMDriver , so, I assume Lenovo has replaced the original MS .dll with their own one ... Anyway, thanks for assisting on this, now the problem is solved – PeteVfi – 2016-08-21T09:48:14.657

no, they simply used a demo driver from the Windows driver kit (WDK) and the wdk string comes from this sample – magicandre1981 – 2016-08-21T18:31:35.460

What does it mean ETL and WPA? – Revious – 2017-12-07T16:03:27.793

@Revious WPA.exe = WIndows Performance Analyzer. The ETL is the file format of Event Tracing for Windows logs. I posted in the comment how to create the file

– magicandre1981 – 2017-12-07T16:10:07.567

@PeteVfi what did you do to fix the problem? – Teoman shipahi – 2018-02-06T18:40:34.147

@Teomanshipahi capture a trace and analyze the tarce in WPA as you see in picture.

– magicandre1981 – 2018-02-07T16:15:51.163

@magicandre1981 thanks. yes, I got that. I was just wondering what he did with the driver specifically? uninstalled, disabled or updated? I did not catch that part. – Teoman shipahi – 2018-02-07T18:14:35.053

@Teomanshipahi OK, sorry, I had this case some 1.5 years ago, so, do not anymore remember exact details on it, but if guessing now, I probably deleted the application involved and causing the extra CPU usage -> Lenovo Quick Optimizer, as it wasn't too essential feature. – PeteVfi – 2018-02-08T09:17:10.450

Another program that can cause this issue is the DisplayLink Driver, which is installed when you use (most) Docking Stations, in my case one from Toshiba.

However, they are aware of the problem and are actually improving the driver in every update.

Support Thread: http://www.displaylink.org/forum/showthread.php?t=64887

Driver Update: http://www.displaylink.com/downloads

Jan Weber

Posted 2016-08-17T14:31:34.507

Reputation: 41

This indicates that a driver of some kind is repeatedly creating a task and hogging the CPU. I've had the problem for a few weeks with the CPU running at 100% with most taken up by WUDFHost.exe

No doubt it occurred after the last major Windows update. Some kind of conflict.

In my case I eventually tracked it down to a driver I had for NFC from NXP semiconductors. I had left this on after doing some development work about a year ago and it seemed innocent enough. I removed the NXP stuff and the drivers then rebooted. Instant solution as the CPU dropped immediately.

It just shows you need to keep things tidy and not go off into flights of fancy in finding a solution. Most 'advice' that I found on the internet relating to this issue were a complete waste of time and many were plain dangerous.

NormanZ

Posted 2016-08-17T14:31:34.507

Reputation: 11