to isolate windows update so you can kill it safely, do

sc config wuauserv type=own

next time service manager starts wuauserv, it will get its own private instance
of svchost.exe, which you can kill with impunity :)

Additionally, "tasklist /svc" can be used to show which services each
svchost.exe is running.