Windows Update Agent Service + High Memory Utilization

[granddaddypurpo]

When I check for windows updates svchost.exe uses 2.5GB of RAM. When I stop the windows update agent service memory utilization drops down and everything is running fine.

I have downloaded and installed the latest version of windows update agent.
I have deleted the software distribution folder and recreated it.
Run the fix it tool that re registers any services related to windows update

I attempted to install the system update readiness tool from (https://www.microsoft.com/en-us/download/details.aspx?id=20858) but it fails to install. It does however generate the CBS logs. The CheckSUR does not find anything but I checked the CBSPersist and this error repeatedly

2016-05-09 13:00:18, Info CBS Failed to internally open package. [HRESULT = 0x800f0805 - CBS_E_INVALID_PACKAGE]
2016-05-09 13:00:18, Info CBS Session: 30517805_1764779813 initialized by client WindowsUpdateAgent.

I had to select what I wanted to upload from the logs due to filesize limitation but please let me know if anything else is needed.

If anyone could think of anything please let me know. I am out of ideas on this one.

 

[torchwood]

Hi GDP
Checksur IS the output from the SURT KB.
Can you just copy/paste your last day entries from the windowsupdate log.
Is your comp upto date otherwise, if not please run this tool and post the results
http://go.microsoft.com/fwlink/?LinkID=52012

Roy

 

[granddaddypurpo]

well the install of SURT failed but there was a Checksur log file and CheckSUR.persist showing nothing was found. I have attached all the logs in the .rar archive but I will go ahead and show you what it contains .

This one is from CheckSUR.log


=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2016-05-09 11:17

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 2318
No errors detected

This one is from CheckSUR.persist


=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2016-05-09 11:17

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 2318
No errors detected

Nothing is found but something is definitely wrong.


I have already checked the computer for viruses using eset, malwarebytes, and adwcleaner. Some items were found in adwcleaner and malwarebytes but nothing serious.

Everytime I check for windows updates Memory spikes. Any ideas?

 

[torchwood]

As i said please copy/paste todays entries from the windowsUpdate log.

Roy

 

[granddaddypurpo]

2016-05-13 02:47:29:959 5824 1668 Misc =========== Logging initialized (build: 7.6.7600.320, tz: -0700) ===========
2016-05-13 02:47:29:959 5824 1668 Misc = Process: c:\program files\windows defender\MpCmdRun.exe
2016-05-13 02:47:29:959 5824 1668 Misc = Module: C:\Windows\system32\wuapi.dll
2016-05-13 02:47:29:959 5824 1668 COMAPI -------------
2016-05-13 02:47:29:959 5824 1668 COMAPI -- START -- COMAPI: Search [ClientId = Windows Defender]
2016-05-13 02:47:29:959 5824 1668 COMAPI ---------
2016-05-13 02:47:29:974 5656 f2c Agent *************
2016-05-13 02:47:29:974 5824 1668 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Windows Defender]
2016-05-13 02:47:29:974 5656 f2c Agent ** START ** Agent: Finding updates [CallerId = Windows Defender]
2016-05-13 02:47:29:974 5656 f2c Agent *********
2016-05-13 02:47:29:974 5656 f2c Agent * Online = Yes; Ignore download priority = No
2016-05-13 02:47:29:974 5656 f2c Agent * Criteria = "(IsInstalled = 0 and IsHidden = 0 and CategoryIDs contains '8c3fcc84-7410-4a95-8b89-a166a0190486' and CategoryIDs contains 'e0789628-ce08-4437-be74-2495b842f43b')"
2016-05-13 02:47:29:974 5656 f2c Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
2016-05-13 02:47:29:974 5656 f2c Agent * Search Scope = {Machine}
2016-05-13 02:47:30:083 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:30:161 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:30:177 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\TMP3481.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:30:224 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:30:271 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\v6-win7sp1-wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:30:271 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:079 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\v6-win7sp1-wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:094 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:094 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:110 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:110 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\TMP4006.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:33:125 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:125 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:125 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:125 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\TMP4017.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:33:141 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:172 5656 f2c Agent Checking for updated auth cab for service 7971f918-a847-4430-9279-4a52d1efe18d at http://ds.download.windowsupdate.com/v11/2/microsoftupdate/redir/v6-muauth.cab
2016-05-13 02:47:33:172 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:172 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:188 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:203 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:313 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:313 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:313 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP40D3.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:33:313 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:328 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:328 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:359 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:359 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:359 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:359 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:359 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP4103.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:33:375 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:375 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:33:375 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:375 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP4113.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:33:391 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:33:391 5656 f2c PT +++++++++++ PT: Starting category scan +++++++++++
2016-05-13 02:47:33:391 5656 f2c PT + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2016-05-13 02:47:37:119 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:37:135 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:135 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP4FC4.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:37:166 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:166 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:37:166 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:197 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:37:213 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:213 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:37:213 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:228 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP5023.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:37:244 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:244 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:37:244 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:244 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP5033.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:37:259 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:37:259 5656 f2c PT +++++++++++ PT: Synchronizing server updates +++++++++++
2016-05-13 02:47:37:259 5656 f2c PT + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2016-05-13 02:47:38:086 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:38:086 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:102 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP538E.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:38:117 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:117 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:38:133 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:164 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:38:164 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:164 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:38:180 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:180 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP53DD.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:38:195 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:195 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 02:47:38:195 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:211 5656 f2c Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP53EE.tmp with dwProvFlags 0x00000080:
2016-05-13 02:47:38:211 5656 f2c Misc Microsoft signed: NA
2016-05-13 02:47:38:211 5656 f2c PT +++++++++++ PT: Synchronizing extended update info +++++++++++
2016-05-13 02:47:38:211 5656 f2c PT + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2016-05-13 02:47:38:398 5656 1994 AU Can not perform non-interactive scan if AU is interactive-only
2016-05-13 02:47:38:398 5656 f2c Agent * Added update {CC6E521D-DE65-4E1D-8191-E6AE6B6ED80E}.200 to search result
2016-05-13 02:47:38:398 5656 f2c Agent * Found 1 updates and 4 categories in search; evaluated appl. rules of 21 out of 35 deployed entities
2016-05-13 02:47:38:648 5656 f2c Agent *********
2016-05-13 02:47:38:648 5656 f2c Agent ** END ** Agent: Finding updates [CallerId = Windows Defender]
2016-05-13 02:47:38:648 5656 f2c Agent *************
2016-05-13 02:47:38:648 5824 1be4 COMAPI >>-- RESUMED -- COMAPI: Search [ClientId = Windows Defender]
2016-05-13 02:47:38:663 5824 1be4 COMAPI - Updates found = 1
2016-05-13 02:47:38:663 5824 1be4 COMAPI ---------
2016-05-13 02:47:38:663 5824 1be4 COMAPI -- END -- COMAPI: Search [ClientId = Windows Defender]
2016-05-13 02:47:38:663 5824 1be4 COMAPI -------------
2016-05-13 02:47:38:710 5824 18f0 COMAPI -------------
2016-05-13 02:47:38:710 5824 18f0 COMAPI -- START -- COMAPI: Download [ClientId = Windows Defender]
2016-05-13 02:47:38:710 5824 18f0 COMAPI ---------
2016-05-13 02:47:38:710 5824 18f0 COMAPI - Forced: No; Download priority: 3
2016-05-13 02:47:38:710 5824 18f0 COMAPI - Updates in request: 1
2016-05-13 02:47:38:710 5824 18f0 COMAPI - ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} Third party service
2016-05-13 02:47:38:741 5824 18f0 COMAPI <<-- SUBMITTED -- COMAPI: Download [ClientId = Windows Defender]
2016-05-13 02:47:38:882 5656 f2c DnldMgr *************
2016-05-13 02:47:38:882 5656 f2c DnldMgr ** START ** DnldMgr: Downloading updates [CallerId = Windows Defender]
2016-05-13 02:47:38:897 5656 f2c DnldMgr *********
2016-05-13 02:47:38:897 5656 f2c DnldMgr * Call ID = {1D9102CD-9BBD-46C3-9ED3-FE643200A62C}
2016-05-13 02:47:38:897 5656 f2c DnldMgr * Priority = 3, Interactive = 1, Owner is system = 1, Explicit proxy = 1, Proxy session id = -1, ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}
2016-05-13 02:47:38:897 5656 f2c DnldMgr * Updates to download = 1
2016-05-13 02:47:38:897 5656 f2c Agent * Title = Definition Update for Windows Defender - KB915597 (Definition 1.219.1665.0)
2016-05-13 02:47:38:897 5656 f2c Agent * UpdateId = {CC6E521D-DE65-4E1D-8191-E6AE6B6ED80E}.200
2016-05-13 02:47:38:897 5656 f2c Agent * Bundles 1 updates:
2016-05-13 02:47:38:897 5656 f2c Agent * {E1CFF641-ED4D-4C17-B68A-CA9762CAB090}.200
2016-05-13 02:47:38:913 5656 f2c DnldMgr *********** DnldMgr: New download job [UpdateId = {E1CFF641-ED4D-4C17-B68A-CA9762CAB090}.200] ***********
2016-05-13 02:47:41:378 5656 f2c DnldMgr * BITS job initialized, JobId = {713E7151-2312-4BC7-B0DF-D6AB72DA0976}
2016-05-13 02:47:41:581 5656 f2c DnldMgr * Downloading from http://download.windowsupdate.com/d..._5adf6de86ed73945cca66fa0bd3ba2d43e3cf3e7.exe to C:\Windows\SoftwareDistribution\Download\b8686e148b308a61e606a0a76aa2c182\5adf6de86ed73945cca66fa0bd3ba2d43e3cf3e7 (full file).
2016-05-13 02:47:41:799 5656 f2c Agent *********

 

[granddaddypurpo]

2016-05-13 02:47:41:799 5656 f2c Agent ** END ** Agent: Downloading updates [CallerId = Windows Defender]
2016-05-13 02:47:41:799 5656 f2c Agent *************
2016-05-13 02:47:42:407 5656 1a68 DnldMgr BITS job {713E7151-2312-4BC7-B0DF-D6AB72DA0976} completed successfully
2016-05-13 02:47:42:470 5656 1a68 Misc Validating signature for C:\Windows\SoftwareDistribution\Download\b8686e148b308a61e606a0a76aa2c182\5adf6de86ed73945cca66fa0bd3ba2d43e3cf3e7 with dwProvFlags 0x00000080:
2016-05-13 02:47:42:485 5656 1a68 Misc Microsoft signed: Yes
2016-05-13 02:47:42:501 5656 1a68 DnldMgr Download job bytes total = 330008, bytes transferred = 330008
2016-05-13 02:47:42:501 5656 1a68 DnldMgr *********** DnldMgr: New download job [UpdateId = {E1CFF641-ED4D-4C17-B68A-CA9762CAB090}.200] ***********
2016-05-13 02:47:42:501 5656 1a68 DnldMgr * All files for update were already downloaded and are valid.
2016-05-13 02:47:42:501 5824 efc COMAPI >>-- RESUMED -- COMAPI: Download [ClientId = Windows Defender]
2016-05-13 02:47:42:501 5824 efc COMAPI - Download call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0)
2016-05-13 02:47:42:501 5824 efc COMAPI ---------
2016-05-13 02:47:42:501 5824 efc COMAPI -- END -- COMAPI: Download [ClientId = Windows Defender]
2016-05-13 02:47:42:501 5824 efc COMAPI -------------
2016-05-13 02:47:42:501 5824 1b38 COMAPI -------------
2016-05-13 02:47:42:501 5824 1b38 COMAPI -- START -- COMAPI: Install [ClientId = Windows Defender]
2016-05-13 02:47:42:501 5824 1b38 COMAPI ---------
2016-05-13 02:47:42:501 5824 1b38 COMAPI - Allow source prompts: Yes; Forced: No; Force quiet: Yes
2016-05-13 02:47:42:501 5824 1b38 COMAPI - Updates in request: 1
2016-05-13 02:47:42:501 5824 1b38 COMAPI - ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} Third party service
2016-05-13 02:47:42:501 5824 1b38 COMAPI - Updates to install = 1
2016-05-13 02:47:42:501 5656 aa8 Agent *************
2016-05-13 02:47:42:501 5824 1b38 COMAPI <<-- SUBMITTED -- COMAPI: Install [ClientId = Windows Defender]
2016-05-13 02:47:42:501 5656 aa8 Agent ** START ** Agent: Installing updates [CallerId = Windows Defender]
2016-05-13 02:47:42:532 5656 aa8 Agent *********
2016-05-13 02:47:42:532 5656 aa8 Agent * Updates to install = 1
2016-05-13 02:47:42:532 5656 aa8 Agent * Title = Definition Update for Windows Defender - KB915597 (Definition 1.219.1665.0)
2016-05-13 02:47:42:532 5656 aa8 Agent * UpdateId = {CC6E521D-DE65-4E1D-8191-E6AE6B6ED80E}.200
2016-05-13 02:47:42:532 5656 aa8 Agent * Bundles 1 updates:
2016-05-13 02:47:42:532 5656 aa8 Agent * {E1CFF641-ED4D-4C17-B68A-CA9762CAB090}.200
2016-05-13 02:47:42:610 5656 aa8 DnldMgr Preparing update for install, updateId = {E1CFF641-ED4D-4C17-B68A-CA9762CAB090}.200.
2016-05-13 02:47:42:626 5448 1910 Misc =========== Logging initialized (build: 7.6.7600.320, tz: -0700) ===========
2016-05-13 02:47:42:626 5448 1910 Misc = Process: C:\Windows\system32\wuauclt.exe
2016-05-13 02:47:42:626 5448 1910 Misc = Module: C:\Windows\system32\wuaueng.dll
2016-05-13 02:47:42:626 5448 1910 Handler :::::::::::::
2016-05-13 02:47:42:626 5448 1910 Handler :: START :: Handler: Command Line Install
2016-05-13 02:47:42:626 5448 1910 Handler :::::::::
2016-05-13 02:47:42:626 5448 1910 Handler : Updates to install = 1
2016-05-13 02:47:43:655 5656 f2c Report REPORT EVENT: {5D0DD4B3-9987-4CF9-B732-8719560F5C3B} 2016-05-13 02:47:38:648-0700 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Windows Defender Success Software Synchronization Windows Update Client successfully detected 1 updates.
2016-05-13 02:47:43:655 5656 f2c Report REPORT EVENT: {8A6BF36B-2070-4C28-872F-10D58B561C0C} 2016-05-13 02:47:42:501-0700 1 162 101 {CC6E521D-DE65-4E1D-8191-E6AE6B6ED80E} 200 0 Windows Defender Success Content Download Download succeeded.
2016-05-13 02:47:43:655 5656 f2c Report CWERReporter finishing event handling. (00000000)
2016-05-13 02:47:49:911 5448 1910 Handler : Command line install completed. Return code = 0x00000000, Result = Succeeded, Reboot required = false
2016-05-13 02:47:49:911 5448 1910 Handler :::::::::
2016-05-13 02:47:49:911 5448 1910 Handler :: END :: Handler: Command Line Install
2016-05-13 02:47:49:911 5448 1910 Handler :::::::::::::
2016-05-13 02:47:50:254 5656 aa8 Agent *********
2016-05-13 02:47:50:254 5656 1994 AU Can not perform non-interactive scan if AU is interactive-only
2016-05-13 02:47:50:254 5656 aa8 Agent ** END ** Agent: Installing updates [CallerId = Windows Defender]
2016-05-13 02:47:50:254 5824 efc COMAPI >>-- RESUMED -- COMAPI: Install [ClientId = Windows Defender]
2016-05-13 02:47:50:254 5656 aa8 Agent *************
2016-05-13 02:47:50:254 5824 efc COMAPI - Install call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0)
2016-05-13 02:47:50:254 5824 efc COMAPI - Reboot required = No
2016-05-13 02:47:50:254 5824 efc COMAPI ---------
2016-05-13 02:47:50:254 5824 efc COMAPI -- END -- COMAPI: Install [ClientId = Windows Defender]
2016-05-13 02:47:50:254 5824 efc COMAPI -------------
2016-05-13 02:47:54:934 5656 f2c Report REPORT EVENT: {78271C87-C468-4DF9-B639-46E3D778BFFC} 2016-05-13 02:47:49:927-0700 1 183 101 {CC6E521D-DE65-4E1D-8191-E6AE6B6ED80E} 200 0 Windows Defender Success Content Install Installation Successful: Windows successfully installed the following update: Definition Update for Windows Defender - KB915597 (Definition 1.219.1665.0)
2016-05-13 02:47:54:934 5656 f2c Report CWERReporter finishing event handling. (00000000)
2016-05-13 08:37:47:017 5656 1994 AU AU setting next sqm report timeout to 2016-05-14 15:37:47
2016-05-13 09:08:05:227 5656 1994 AU ########### AU: Uninitializing Automatic Updates ###########
2016-05-13 09:08:05:227 5656 1994 Report CWERReporter finishing event handling. (00000000)
2016-05-13 09:08:05:227 5656 1994 Service *********
2016-05-13 09:08:05:227 5656 1994 Service ** END ** Service: Service exit [Exit code = 0x240001]
2016-05-13 09:08:05:227 5656 1994 Service *************
2016-05-13 09:08:08:809 5656 1e94 Misc =========== Logging initialized (build: 7.6.7600.320, tz: -0700) ===========
2016-05-13 09:08:08:809 5656 1e94 Misc = Process: C:\Windows\system32\svchost.exe
2016-05-13 09:08:08:809 5656 1e94 Misc = Module: c:\windows\system32\wuaueng.dll
2016-05-13 09:08:08:809 5656 1e94 Service *************
2016-05-13 09:08:08:819 5656 1e94 Service ** START ** Service: Service startup
2016-05-13 09:08:08:819 5656 1e94 Service *********
2016-05-13 09:08:08:819 5656 1e94 Agent * WU client version 7.6.7600.320
2016-05-13 09:08:08:819 5656 1e94 Agent * Base directory: C:\Windows\SoftwareDistribution
2016-05-13 09:08:08:819 5656 1e94 Agent * Access type: No proxy
2016-05-13 09:08:08:829 5656 1e94 Agent * Network state: Connected
2016-05-13 09:08:14:520 2144 1d30 Misc =========== Logging initialized (build: 7.6.7600.320, tz: -0700) ===========
2016-05-13 09:08:14:520 2144 1d30 Misc = Process: C:\Windows\LTSvc\LTSVC.exe
2016-05-13 09:08:14:520 2144 1d30 Misc = Module: C:\Windows\system32\wuapi.dll
2016-05-13 09:08:14:520 2144 1d30 COMAPI ----------- COMAPI: IUpdateServiceManager::AddService2 -----------
2016-05-13 09:08:14:520 2144 1d30 COMAPI - Service ID = {7971f918-a847-4430-9279-4a52d1efe18d}
2016-05-13 09:08:14:520 2144 1d30 COMAPI - Allow pending registration = Yes; Allow online registration = Yes; Register service with AU = Yes
2016-05-13 09:08:14:520 2144 1d30 COMAPI - Authorization cab path = <NULL>
2016-05-13 09:08:14:530 5656 1cec Report CWERReporter::Init succeeded
2016-05-13 09:08:14:530 5656 1cec Agent *********** Agent: Initializing Windows Update Agent ***********
2016-05-13 09:08:14:530 5656 1cec Agent * Prerequisite roots succeeded.
2016-05-13 09:08:14:530 5656 1cec Agent *********** Agent: Initializing global settings cache ***********
2016-05-13 09:08:14:530 5656 1cec Agent * WSUS server: <NULL>
2016-05-13 09:08:14:530 5656 1cec Agent * WSUS status server: <NULL>
2016-05-13 09:08:14:530 5656 1cec Agent * Target group: (Unassigned Computers)
2016-05-13 09:08:14:530 5656 1cec Agent * Windows Update access disabled: No
2016-05-13 09:08:14:590 5656 1cec DnldMgr Download manager restoring 0 downloads
2016-05-13 09:08:14:600 2144 1d30 COMAPI - Added service, URL = https://fe2.update.microsoft.com/v6/
2016-05-13 09:08:14:600 2144 1d30 COMAPI -------------
2016-05-13 09:08:14:600 2144 1d30 COMAPI -- START -- COMAPI: Search [ClientId = LabTech]
2016-05-13 09:08:14:600 2144 1d30 COMAPI ---------
2016-05-13 09:08:14:600 2144 1d30 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = LabTech]
2016-05-13 09:08:14:710 5656 1e94 Report *********** Report: Initializing static reporting data ***********
2016-05-13 09:08:14:710 5656 1e94 Report * OS Version = 6.1.7601.1.0.65792
2016-05-13 09:08:14:710 5656 1e94 Report * OS Product Type = 0x00000030
2016-05-13 09:08:14:720 5656 1e94 Report * Computer Brand = TOSHIBA
2016-05-13 09:08:14:720 5656 1e94 Report * Computer Model = Satellite L55-A
2016-05-13 09:08:14:720 5656 1e94 Report * Bios Revision = 1.40
2016-05-13 09:08:14:720 5656 1e94 Report * Bios Name = InsydeH2O Version 03.72.301.40
2016-05-13 09:08:14:720 5656 1e94 Report * Bios Release Date = 2014-04-28T00:00:00
2016-05-13 09:08:14:720 5656 1e94 Report * Locale ID = 1033

 

[granddaddypurpo]

2016-05-13 09:08:14:720 5656 ef4 Agent *************
2016-05-13 09:08:14:720 5656 ef4 Agent ** START ** Agent: Finding updates [CallerId = LabTech]
2016-05-13 09:08:14:720 5656 ef4 Agent *********
2016-05-13 09:08:14:720 5656 ef4 Agent * Online = Yes; Ignore download priority = No
2016-05-13 09:08:14:720 5656 ef4 Agent * Criteria = "IsInstalled=1 or IsInstalled=0"
2016-05-13 09:08:14:720 5656 ef4 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
2016-05-13 09:08:14:720 5656 ef4 Agent * Search Scope = {Machine}
2016-05-13 09:08:14:720 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:14:740 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:14:740 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\TMPC935.tmp with dwProvFlags 0x00000080:
2016-05-13 09:08:14:750 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:14:750 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\v6-win7sp1-wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:14:760 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:17:301 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\v6-win7sp1-wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:17:311 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:17:321 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:17:321 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:17:331 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\TMPD354.tmp with dwProvFlags 0x00000080:
2016-05-13 09:08:17:341 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:17:341 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:17:351 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:17:351 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\TMPD374.tmp with dwProvFlags 0x00000080:
2016-05-13 09:08:17:361 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:17:361 5656 ef4 Agent Checking for updated auth cab for service 7971f918-a847-4430-9279-4a52d1efe18d at http://ds.download.windowsupdate.com/v11/2/microsoftupdate/redir/v6-muauth.cab
2016-05-13 09:08:17:361 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:17:361 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:17:491 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\AuthCabs\authcab.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:17:501 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:549 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:36:559 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:559 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP1E79.tmp with dwProvFlags 0x00000080:
2016-05-13 09:08:36:569 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:569 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:36:579 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:609 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:36:619 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:619 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:36:629 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:629 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP1EB8.tmp with dwProvFlags 0x00000080:
2016-05-13 09:08:36:639 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:639 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:08:36:649 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:649 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMP1ED9.tmp with dwProvFlags 0x00000080:
2016-05-13 09:08:36:659 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:08:36:659 5656 ef4 PT +++++++++++ PT: Synchronizing server updates +++++++++++
2016-05-13 09:08:36:659 5656 ef4 PT + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2016-05-13 09:08:53:982 5656 ef4 Driver Matched driver to device ACPI\TOS1150
2016-05-13 09:08:53:982 5656 ef4 Driver Status: 0x180000a, ProblemNumber: 00000000
2016-05-13 09:08:53:982 5656 ef4 Driver Matched driver to device PCI\VEN_168C&DEV_0036&SUBSYS_061211AD&REV_01
2016-05-13 09:08:53:982 5656 ef4 Driver Status: 0x180200a, ProblemNumber: 00000000
2016-05-13 09:08:53:982 5656 ef4 Driver Matched driver to device MONITOR\DELA0B3
2016-05-13 09:08:53:982 5656 ef4 Driver Status: 0x180600a, ProblemNumber: 00000000
2016-05-13 09:08:53:982 5656 ef4 Driver Matched driver to device PCI\VEN_8086&DEV_0166&SUBSYS_FA101179&REV_09
2016-05-13 09:08:53:982 5656 ef4 Driver Status: 0x180200a, ProblemNumber: 00000000
2016-05-13 09:08:54:312 5656 1e94 AU ########### AU: Initializing Automatic Updates ###########
2016-05-13 09:08:54:342 5656 1e94 AU # AU disabled through Policy
2016-05-13 09:08:54:342 5656 1e94 AU # Will interact with non-admins (Non-admins are elevated (User preference))
2016-05-13 09:08:54:342 5656 1e94 AU Initializing featured updates
2016-05-13 09:08:54:342 5656 1e94 AU Found 0 cached featured updates
2016-05-13 09:08:54:342 5656 1e94 AU Successfully wrote event for AU health state:0
2016-05-13 09:08:54:342 5656 1e94 AU Successfully wrote event for AU health state:0
2016-05-13 09:08:54:352 5656 1e94 AU AU finished delayed initialization
2016-05-13 09:09:20:097 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:09:20:097 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:113 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMPC890.tmp with dwProvFlags 0x00000080:
2016-05-13 09:09:20:129 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:129 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:09:20:129 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:160 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\v6-muredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:09:20:160 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:160 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:09:20:175 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:175 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMPC8CF.tmp with dwProvFlags 0x00000080:
2016-05-13 09:09:20:175 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:175 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2016-05-13 09:09:20:191 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:191 5656 ef4 Misc Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMPC8E0.tmp with dwProvFlags 0x00000080:
2016-05-13 09:09:20:191 5656 ef4 Misc Microsoft signed: NA
2016-05-13 09:09:20:191 5656 ef4 PT +++++++++++ PT: Synchronizing extended update info +++++++++++
2016-05-13 09:09:20:191 5656 ef4 PT + ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, Server URL = https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx
2016-05-13 09:09:23:873 5656 1e94 AU Can not perform non-interactive scan if AU is interactive-only
2016-05-13 09:34:35:688 5656 1e94 AU ########### AU: Uninitializing Automatic Updates ###########
2016-05-13 09:34:35:688 5656 ef4 Agent * WARNING: Failed to filter search results, error = 0x8024000B
2016-05-13 09:34:35:797 5656 ef4 Agent *********
2016-05-13 09:34:35:797 5656 ef4 Agent ** END ** Agent: Finding updates [CallerId = LabTech]
2016-05-13 09:34:35:797 5656 ef4 Agent *************
2016-05-13 09:34:35:938 2144 1abc COMAPI >>-- RESUMED -- COMAPI: Search [ClientId = LabTech]
2016-05-13 09:34:35:938 5656 1e94 Agent Sending shutdown notification to client
2016-05-13 09:34:35:953 2144 1c4c COMAPI WARNING: Received service shutdown/self-update notification.
2016-05-13 09:34:35:969 5656 1e94 Report CWERReporter finishing event handling. (00000000)
2016-05-13 09:34:35:969 5656 1e94 Report CWERReporter finishing event handling. (00000000)
2016-05-13 09:34:35:969 5656 1e94 Report CWERReporter finishing event handling. (00000000)
2016-05-13 09:34:35:969 2144 1abc COMAPI - Updates found = 0
2016-05-13 09:34:35:969 2144 1abc COMAPI - WARNING: Exit code = 0x00000000, Result code = 0x8024001E
2016-05-13 09:34:35:969 2144 1abc COMAPI ---------
2016-05-13 09:34:35:969 2144 1abc COMAPI -- END -- COMAPI: Search [ClientId = LabTech]
2016-05-13 09:34:35:969 2144 1abc COMAPI -------------
2016-05-13 09:34:35:969 2144 1d30 COMAPI WARNING: Operation failed due to earlier error, hr=8024001E
2016-05-13 09:34:35:969 2144 1d30 COMAPI FATAL: Unable to perform synchronous search. (hr=8024001E)
2016-05-13 09:34:36:281 5656 1e94 Service *********
2016-05-13 09:34:36:281 5656 1e94 Service ** END ** Service: Service exit [Exit code = 0x240001]
2016-05-13 09:34:36:281 5656 1e94 Service *************

 

[torchwood]

thanks for that.
Very interesting according to that log
you are only running W7,
But the update agent is for W7 service pack 1 >> uninstall it <<.
THEN
please use this link to update to SP1.
https://www.google.co.uk/url?sa=t&r...d=5842&usg=AFQjCNGudX8cGUhAcGZhPPILw2f2MIkU4w


IF your computer is showing this (see screenshot).
please tell me BEFORE proceeding to update to SP1

On a final note it may be that you do not have download rights to W7 as your model was sold with W8.

Roy

 

[granddaddypurpo]

The computer does show that it is Service Pack 1.

isnt this OS Version number windows 7 with SP1?
2016-05-13 09:08:14:710 5656 1e94 Report * OS Version = 6.1.7601.1.0.65792

I believe the computer came with Windows 7. Even if I downgraded and went to Windows 7 there shouldn't be any problem with downloading windows updates. Its been done in the past. I have downgraded/upgraded to other versions of windows on other computers and have always been able to download windows updates.

any other ideas?

 

[granddaddypurpo]

Windows update and High CPU Usage

When ever this computer checks for windows updates CPU spikes up to 100% Will not go down at all.

I have updated the windows update agent.
I have ran a few fix it tools from microsoft.
I have determined its the windows update agent service causing CPU spikes because when I kill the service everything is back to normal.
I have scanned for viruses using, eset, hitmanpro, malwarebytes, and adwcleaner
I have deleted the softwaredistribution folder
i tried to install the windows update readiness tool. Nothing was found. Take a look at the log file below

-I have attached the windowsupdate.log file

Any ideas?

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2016-05-12 11:58

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 1618

 

[torchwood]

Are you using a network server using Labtech,
see link,
https://docs.labtechsoftware.com/knowledgebase/article/6504

could you also run/paste the results from this
http://go.microsoft.com/fwlink/?LinkID=52012

Roy

 

[granddaddypurpo]

What do you think torchwood?

EDIT:Whoops sorry I didnt realize there was a second page already. Labtech is a remote management software that I use to manage my computers. I use it to push updates instead of WSUS. It interacts with the windows update agent by telling it to check for updates, install certain update, etc....



Im not around the computer to run the tool but once I get the chance I will do that.

Thanks again!

 

[torchwood]

Hi GDP,
the article i linked states that it does cause high usage.

Roy

 

[granddaddypurpo]

"LabTech Agent on Windows Server 2012 R2 shows high memory usage after Remote Session or Tunnel commands executed."

That is only after a remote session or tunnel. We dont make sure of this feature because we use something else. Also I have other workstations setup with this and the behavior is not the same.

 

[torchwood]

Hi GDP,
From WU log,
compare the service ID's to a working comp, All 0's ?????

016-05-13 02:47:29:974 5656 f2c Agent * Criteria = "(IsInstalled = 0 and IsHidden = 0 and CategoryIDs contains '8c3fcc84-7410-4a95-8b89-a166a0190486' and CategoryIDs contains 'e0789628-ce08-4437-be74-2495b842f43b')"
2016-05-13 02:47:29:974 5656 f2c Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service

Roy

 

[granddaddypurpo]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-FBCKQ-HQK9X-W7HJV
Windows Product Key Hash: Z3VHq7PXzk9HbMvXAJYG30qNv1M=
Windows Product ID: 00371-OEM-9046196-72901
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {283EC215-EF48-4E1D-B82E-E42462AB93A9}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150722-0600
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{283EC215-EF48-4E1D-B82E-E42462AB93A9}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-W7HJV</PKey><PID>00371-OEM-9046196-72901</PID><PIDType>3</PIDType><SID>S-1-5-21-822429819-420199823-2234441562</SID><SYSTEM><Manufacturer>TOSHIBA</Manufacturer><Model>Satellite L55-A</Model></SYSTEM><BIOS><Manufacturer>Insyde Corp.</Manufacturer><Version>1.40</Version><SMBIOSVersion major="2" minor="7"/><Date>20140428000000.000000+000</Date></BIOS><HWID>EFF63D07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>1</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>TOSINV</OEMID><OEMTableID>TOSINV00</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-461-972901-02-1033-7600.0000-0202014
Installation ID: 015226190571858764027741836225173945564755593330211994
Processor Certificate URL: SpcService Web Service
Machine Certificate URL: RacService Web Service
Use License URL: UseLicenseService Web Service
Product Key Certificate URL: PkcService Web Service
Partial Product Key: W7HJV
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 5/23/2016 10:10:02 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 3:25:2016 16:49
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAEAAAACAAAAAwABAAEAonZirI4OWPjeSoAiCowA3DLxrFp0KpZj

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC TOSINV TOSINV00
FACP TOSINV TOSINV00
DBGP TOSINV TOSINV00
HPET TOSINV TOSINV00
BOOT TOSINV TOSINV00
MCFG TOSINV TOSINV00
WDAT TOSINV TOSINV00
UEFI TOSINV TOSINV00
ASF! TOSINV TOSINV00
SLIC TOSINV TOSINV00
SSDT INSYDE CR CRB
ASPT TOSINV TOSINV00
SSDT INSYDE CR CRB
FPDT TOSINV TOSINV00
MSDM TOSINV TOSINV00
SSDT INSYDE CR CRB
SSDT INSYDE CR CRB

 

[granddaddypurpo]

What does the service IDs do? Here is the output from the program as you requested. Do you have any ideas?

 

[torchwood]

Hi GDP,
in my previous post i asked about the 3rd party service id,
i suspect its the licencing code you should get from Labtech.

From your Mgadiag
Processor Certificate URL: SpcService Web Service
Machine Certificate URL: RacService Web Service
Use License URL: UseLicenseService Web Service
Product Key Certificate URL: PkcService Web Service

Standard Mgadiag (mine actually)
Processor Certificate URL go.microsoft.com/fwlink/?LinkID 88338
Machine Certificate URL: go.microsoft.com/fwlink/?LinkID 88339
Use License URL: go.microsoft.com/fwlink/?LinkID 88341
Product Key Certificate URL: go.microsoft.com/fwlink/?LinkID 88340


the link ID's at the end of mine are for MS servers
those zero's in the your report are sending it to the web service
(did you check/compare on a working one)
My guess, (as i know nothing about how labtech is set up to update
it should be labtechs ID server, or your domain computer,
Its going round and round in a loop causing the high usage

Note if Labtech provided you with an MS activation key >>>DO NOT<<< post it

Roy

 

[granddaddypurpo]

My processor certificate URL is the same as your. Mine says SPCservice web service but redirects to the same link you have. Same with the other certificates/urls. Could you explain some more about this please?

All labtech does is it tells the workstation to check for updates/install certain updates. It doesn't push updates or install updates.

 

[granddaddypurpo]

i ran the tool again and I actually get the same output as your machine. I think for whatever reason when I copy/paste it formatted the URL into a hyperlink.