OK, this is actually my own answer to an unwritten question on this title problem chasen today ...

Why there is WUDFHost.exe constantly on some 12-20% CPU?

According to several posts on the net "The WUDFHost.exe process is part of Windows Driver Foundation of Microsoft", and an essential one, if found on %WinDir%\System32 folder. It is pointed to be taking care of "User-mode Drivers".

After checking the drivers on this about half-year old laptop, first 3 most critical ones manually and also updating them, I didn't still note any change on the CPU list. Then I went on checking others automatically this time with the Free Driver Booster 3, and it found some 12 more drivers outdated. So, now I let twice some 3-4 "easy" ones get updated automatically by DB3 and there between checked the actual CPU list, but still no change. But, after an automatic DB3 update of the last "critical/difficult" 5 m/b drivers the WUDFHost.exe was on 0% CPU, great! Note also, that all of the updated 15 drivers were just 3-12 months old.

Edit 18.08.2016 10:30 (GMT+3):

Sorry, to inform, but this cure was a short joy, after Windows 10 was Upgraded from 1511 to 1607 the problem did return, i.e. back to 15-17% CPU, and now the DB3 did recognise only up-to-date drivers ... See below my comments on this.

Edit 18.08.2016 12:30 (GMT+3):

OK, the new troublemaker identified -> Lenovo Quick Optimizer, see below my comment on it, and now this case hopefully finally cleared.

  • Install the WPT (part of the Win10 SDK: dev.windows.com/en-us/downloads/windows-10-sdk), run WPRUI.exe, select "First Level", under Resource select CPU usage and click on start. Now capture 1 minute of the CPU usage. After 1 minute click on Save. Zip the large ETL file (+ NGENPDB folder) into 1 zip, upload the zip (OneDrive, dropbox, google drive) and post the share link here. – magicandre1981 Aug 17 '16 at 15:52
  • @magicandre1981 OK, thanks for the instructions. Now I did the CPU recording with WPR and checked it with WPA, and, ooops ... now the WUDFHost.exe proved to be once again at the 15% level, a few hours ago it was long time at 0% only, as described above ... But, what happened now there between, Windows 10 Upgrade from 1511 to1607 was performed with restart etc.! Now I shall take a break with this, and will come back with a new report first thing on the morning. – PeteVfi Aug 17 '16 at 17:00
  • Sorry, checked once again the status of the WUDFHost.exe on this particular quite new laptop, and as now it is back on the 15-17% CPU level, I have to give up digging more into the far deep in this, due to time limits, and will let it so far be as such ... So, if anyone else has interest on this case, please go on on this, and I would be grateful for some new better real cure hints or solution for this annoying problem ... – PeteVfi Aug 17 '16 at 22:27
  • share the ETL that you captured when you have the issue. Maybe I see more details – magicandre1981 Aug 18 '16 at 4:27
  • OK, please, here you have the link for the captured .zip -> dl.dropboxusercontent.com/u/4802168/WPR%20Files%20Lenovo.zip – PeteVfi Aug 18 '16 at 7:37
up vote 4 down vote accepted

Analyzing the ETL with WPA shows, that the driver iMDriver.dll causes the WUDFHost.exe cpu usage

enter image description here
(Click images to enlarge)

Maybe this file is also part of the Lenovo Quick Optimizer. This process also causes a lot of CPU usage:

enter image description here

The driver and the program do IO calls via Windows Usermode Driver framework (WUDF) and this is the usage you see.

  • Product: Windows (R) Win 7 DDK driver Description: WUDF: iMDriver – PeteVfi Aug 21 '16 at 9:22
  • OK, yes, I checked your analysis and findings, thanks for great work. So, it's obvious, that WUDFHost.exe was servicing Lenovo Quick Optimizer on some 15-17% CPU level, and now remaining there on 0% CPU. Regarding the iMDriver.dll, I found it on \System32\drivers\UMDF noted produced by Lenovo, but, when checking on net, it's noted -> Product: Windows (R) Win 7 DDK driver Company: Windows (R) Win 7 DDK provider Description: WUDF: iMDriver , so, I assume Lenovo has replaced the original MS .dll with their own one ... Anyway, thanks for assisting on this, now the problem is solved – PeteVfi Aug 21 '16 at 9:48
  • no, they simply used a demo driver from the Windows driver kit (WDK) and the wdk string comes from this sample – magicandre1981 Aug 21 '16 at 18:31
  • What does it mean ETL and WPA? – Revious Dec 7 '17 at 16:03
  • 1
    @Revious WPA.exe = WIndows Performance Analyzer. The ETL is the file format of Event Tracing for Windows logs. I posted in the comment how to create the file – magicandre1981 Dec 7 '17 at 16:10

Another program that can cause this issue is the DisplayLink Driver, which is installed when you use (most) Docking Stations, in my case one from Toshiba.

However, they are aware of the problem and are actually improving the driver in every update.

Support Thread: http://www.displaylink.org/forum/showthread.php?t=64887

Driver Update: http://www.displaylink.com/downloads

This indicates that a driver of some kind is repeatedly creating a task and hogging the CPU. I've had the problem for a few weeks with the CPU running at 100% with most taken up by WUDFHost.exe

No doubt it occurred after the last major Windows update. Some kind of conflict.

In my case I eventually tracked it down to a driver I had for NFC from NXP semiconductors. I had left this on after doing some development work about a year ago and it seemed innocent enough. I removed the NXP stuff and the drivers then rebooted. Instant solution as the CPU dropped immediately.

It just shows you need to keep things tidy and not go off into flights of fancy in finding a solution. Most 'advice' that I found on the internet relating to this issue were a complete waste of time and many were plain dangerous.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.