Windows Update svchost high CPU and RAM usage

[Layback Bear]

radugb so you understand.

Posting the log here that torchwood has requested might point to the reason for the problems you are having. The log will help torchwood give proper guidance to you.
To give proper guidance the helpers with your problem need information.
Without information we are in the same boat your are and don't what to do next.

Completing this tutorial by Brink exactly as the tutorial guides would be very helpful.

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

I hope you understand.

 

[radugb]

I do now, thank you both. I did not read the disclaimer about the error message when clicking COPY in the MGA tool. I thought I had done something wrong.

Here is the log from the MGA.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-CBG4J-8C6R2-TCVBD
Windows Product Key Hash: 6PX60gjAL/BLWe2bhoeSejdXJaw=
Windows Product ID: 00426-OEM-8992662-00008
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {56921E10-05FF-40BB-B910-6CE3D54FD9A4}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.151230-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{56921E10-05FF-40BB-B910-6CE3D54FD9A4}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-TCVBD</PKey><PID>00426-OEM-8992662-00008</PID><PIDType>2</PIDType><SID>S-1-5-21-57380912-1866141026-3612551903</SID><SYSTEM><Manufacturer>Alienware</Manufacturer><Model>M17x</Model></SYSTEM><BIOS><Manufacturer>Alienware</Manufacturer><Version>A10</Version><SMBIOSVersion major="2" minor="6"/><Date>20110117000000.000000+000</Date></BIOS><HWID>32800C00018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ALWARE</OEMID><OEMTableID>ALIENWRE</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00178-926-600008-02-1033-7601.0000-2772013
Installation ID: 001461464685694631556584321654302042995730771034304011
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: TCVBD
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 3/1/2016 2:32:38 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 12:30:2015 23:39
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: OgAAAAAABAABAAEAAAACAAAABgABAAEAln2ILFxunrsiObbP8O9oYGI9soV/SKRyhppsDdaBQOF2Vg==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            PTLTD              APIC  
  FACP            INTEL         CRESTLNE
  HPET            INTEL         CRESTLNE
  BOOT            PTLTD         $SBFTBL$
  MCFG            INTEL         CRESTLNE
  OSFR            DELL          DELL    
  SLIC            ALWARE        ALIENWRE
  SSDT            PmRef        CpuPm
  SSDT            PmRef        CpuPm
  SSDT            PmRef        CpuPm

 

[Layback Bear]

Thanks for posting the log.
I don't see a problem with the log.
I will go back to watching and get out of the way.

 

[torchwood]

thanks

Hi Radugb,
Thanks for that knocks another thing out of the equation.
Can you rerun sfc /scannow, (should be a lot smaller).

1. Right-click and on the CBS folder and select Copy.
2. Minimise all open windows and right-click on your Desktop, then select Paste.
3. Right-click on the CBS folder on your Desktop and select Send to > Compressed (zipped) folder.
4. A file, CBS.zip should appear on your Desktop.

Lets have another look to see which KB/s is giving us grief and why.


Roy

 

[radugb]

Here it is. You can ignore the errors about the fontext.dll being corrupt. I had changed an icon resource in it. As I did in the shelldll32 as well. Both of those mods have not caused any issues in 6 years so I'm not sure why they would now.

And I have Windows Update service disabled in the Services control panel. Otherwise the system would sometimes lock up during startup.

 

[torchwood]

Hi Rad,
Thats got to be one of the strangest CBS logs i've seen

1 it appears to be correcting/re-registering most of the major components everytime you start up
2 the activation code on this machine is not the base OEM SLP,
which implies that an activation exploit has been used.

From what i can see that comp never came with Ultimate, installed 2011?

these are probably why its pushing up the usage on that service, (windows activation).

I suggest you use the re install the OS and code shown on the OEM sticker.

Roy

 

[radugb]

Hi Rad,
Thats got to be one of the strangest CBS logs i've seen

1 it appears to be correcting/re-registering most of the major components everytime you start up
2 the activation code on this machine is not the base OEM SLP,
which implies that an activation exploit has been used.

From what i can see that comp never came with Ultimate, installed 2011?

these are probably why its pushing up the usage on that service, (windows activation).

I suggest you use the re install the OS and code shown on the OEM sticker.

Roy

Thank you for your reply. It did come W7 Ultimate installed. But I had to have the hard drive, motherboard and battery replaced all in one shot (along with the bottom chassis). The depot reinstalled W7 for me. That was 2011.

I wonder why the system would be re-registering most of the major components during every startup.

 

[torchwood]

Hi Radugb,
Well that explains why it keeps checking.
When the Depot, swapped out the motherboard and harddrive, the WAT automatically reported it to the MS servers, which basically said NEW computer where's my new key to go with it.
(Its the primary validation check).
It should have given you the option to reregister the comp.
This has not been done, because of the way this exploit is working.

As this is an OEM install, (TIED to the original motherboard) and because of what has been done to circumvent the WAT. This Installation is classified as NON-Genuine, and no further help will be forthcoming.

When you re-install the original installation and use the code on the sticker,
You WILL have to reregister your OS via the phone option, explain to them what/why you have done
they MIGHT re-issue you a new key.

Roy