High memory and CPU usage by TrustedInstaller, huge CBS.log files and growing

Hello Enzo,

Welcome to Microsoft community Forum.

As per the description, I understand that you noticed very high memory and CPU usage by TrustedInstaller.exe and makecab.exe and reducing free space on C drive due to large and growing CBS log files. You deleted all these files and makecab.exe stopped after this but TrustedInstaller still shows causing high CPU percentage randomly and CBS logs file keeps on growing.

I would appreciate if you can provide us the following information to help us understand the issue better.

1. Do you have more than one security software installed on your computer?
2. Do you have any WMI (Windows Module Installer) query checking and reporting Windows Update status running in the background?

TrustedInstaller is used by a service called “Windows Module Installer” which is used to install Windows 7 system modules. The system modules include Windows Update and Automatic Updates which automatically scans your system to check for any new updates and hotfixes available. So when scheduled Windows Update is performing its update scan or check on your system, the TrustedInstaller.exe process increases the CPU usage.

Also, the CBS.logs data file keeps on updating itself after each SFC Scan. The SFC.exe program writes the details of each verification operation and of each repair operation to the CBS.log file. The CBS.persist.log is generated when the CBS gets to be around 50 meg in size. CBS.log is copied to cbs.persist.log and a new cbs.log file is started.

These logs are useful only for troubleshooting issues. If you are sure your system is running fine, you can delete this file. SFC.exe will create a new one automatically, next time it is run.

The simplest resolution for the TrustedInstaller high CPU usage problem is to wait for a while for the TrustedInstaller.exe to complete its job. Once it finishes running the tasks, the CPU usage rate will return to normal.

However, if you want to stop TrustedInstaller.exe from taking up all your CPU resource, here’s a suggestion that may help.

Step 1: Disable Windows from automatically updating.

Here’s how: Turn automatic updating on or off
http://windows.microsoft.com/en-us/windows/turn-automatic-updating-on-off#turn-automatic-updating-on-off=windows-7

After disabling automatic updates, depending on your preference, you can change the way Windows notify you about updates.

Refer this article: Change how Windows installs or notifies you about updates

http://windows.microsoft.com/en-us/windows/change-windows-update-installation-notification#1TC=windows-7

Step 2: Clear Problem History.

The following fix is intended for situations where trustedinstaller.exe causes problems due to the Problem Reports and Solutions history maintained in Windows 7.

Refer the steps to clear the history from:

How do I clear the problem report history from my computer?

http://windows.microsoft.com/en-US/windows7/How-do-I-clear-the-problem-report-history-from-my-computer

More information about problem reports:

See all problem reports for this computer
http://windows.microsoft.com/en-us/windows/support#top-solutions=windows-7

Hope this helps. Please let us know the results. Feel free to write us back for any further assistance, we’ll be glad to assist you.

Hi, thank you for your answer.

I would appreciate if you can provide us the following information to help us understand the issue better.

1. Do you have more than one security software installed on your computer?
2. Do you have any WMI (Windows Module Installer) query checking and reporting Windows Update status running in the background?

1. I have Avast (the free version) and Spybot 2.1

2. How can i check that? Taskmanager shows two WmiPrvSE.exe running (few MBs of memory and no cpu usage)

I disabled Windows Updates and cleared the problem history (step 1 and 2) but the problem is still here.

After step 1-2 i cleared all the log files and did a system reboot. After the reboot everything looked fine, then i opened Firefox to come here and post and all of a sudden TrustedInstaller.exe comes up and take 50% of CPU and CBS.log goes crazy. It's been 5 minutes now and the TrustedInstaller is still up and the log file is already 1GB!

I tried to give a look at the log but i don't know what should i be looking for...

Hello Enzo,

Thank you for your reply, appreciate the time taken by you in keeping us updated on the status of the issue.

I would have you place the computer in clean boot state to eliminate any third party program which is running in the background contributing to TrustedInstaller high CPU percentage and large logs files.

Clean boot is a process of starting your computer by using a minimal set of drivers and startup programs so that you can determine whether a background program is interfering with your computer performance.

Please refer the Microsoft article below to get more information on this.

How to perform a clean boot in Windows

http://support.microsoft.com/kb/929135

Please refer the section “How to reset the computer to start normally after clean boot troubleshooting” in the article below and follow the steps to bring your computer to the normal state.

Please reply with the results, we’ll be glad to assist you.

I would have you place the computer in clean boot state to eliminate any third party program which is running in the background contributing to TrustedInstaller high CPU percentage and large logs files

[..]

Please reply with the results, we’ll be glad to assist you.

I placed my computer in clean boot state and i tried to use it a bit... the problem is still here.

In particular i also tried this: i cleaned the log file, i did a system reboot (clean boot) and then i did absolutely nothing. After 30 minutes or so the log file was already over 2GB.

It's really frustrating because i don't even know why and when is logging like that...

Hello Enzo,

Thank you for your reply.

Since the problem persists even in clean boot state, this indicates that the issue is not due to some third party programs. Virus/malware infection or missing or corrupt system files could be possible a cause for this issue.

Though you have already scanned your computer with a number of virus removal tool but it looks like either they were not removed completely or some important system files must have got damaged in that process.

I would recommend you to scan your computer with Microsoft Safety Scanner once again, just to make sure that your computer is free of all infections.

Here is the link for Microsoft Safety Scanner

http://www.microsoft.com/security/scanner/en-us/default.aspx

Note: Any data files that are infected may only be cleaned by deleting the file entirely, which means there is a potential for data loss.

After running the scan run Microsoft System file checker tool SFC /SCANNOW to scan the system integration and fix system file corruption (if any).

The sfc /scannow (System File Checker) command scans all protected system files, and replaces incorrect versions with correct Microsoft versions.

Use the System File Checker tool to troubleshoot missing or corrupted system files.
http://support.microsoft.com/kb/929833/en-us

Hope this helps. Please let us know the results. Feel free to write us back for any further assistance, we’ll be glad to assist you

Thank you for your help, i really appreciate it.

I tried another scan with Microsoft Safety Scanner but nothing came up.

Same result with the sfc /scannow, apparently it didn't find anything wrong.   Should i search for something in particular into the log?

Hello Enzo,

Thank you for your reply.

Let’s try to create a new user account with Administrator privilege to check if you get the same result there as well.

To create a new user account please follow the steps below:

1. To open User Accounts, click the Start, click Control Panel, click User Accounts and Family Safety, and then click User Accounts.
2. Click Manage another account. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
3. Click Create a new account.
4. Type the name you want to give the user account, click an account type, and then click Create Account.

Please reply with the results, we’ll be glad to assist you further.

Let’s try to create a new user account with Administrator privilege to check if you get the same result there as well.

[..]

Please reply with the results, we’ll be glad to assist you further.

I tried and it's the same result. Nothing comes up from the scans, meanwhile the CBS.log goes well over 2GB.

I noticed that in the directory C:\Windows\Logs\CBS there is a file called FilterList.log which contains only this:

                                   aswSP               5               0
                               aswMonFlt               6               0
                                  aswSnx               4               0
                                   luafv               1               0
                                FileInfo               6               0

Maybe it can help, maybe it can't...i don't know what it is.

Hello Enzo,

Thank you for your reply and apology for the delayed response. I really appreciate your consistent co-operation and efforts towards getting this issue resolved.

Let’s download and run Windows Process Monitor from the link below and check if it indicates towards the troubling activity in the background.

Process Monitor is advanced monitoring tool for Windows that shows real time file system, registry and process activity.

Process Monitor V3.1

http://technet.microsoft.com/en-us/sysinternals/bb896645

(Holds good for Windows 7)

Please check and let us know the results, it’s a pleasure to work with you and be an assistance.

Process Monitor V3.1

http://technet.microsoft.com/en-us/sysinternals/bb896645

(Holds good for Windows 7)

Please check and let us know the results, it’s a pleasure to work with you and be an assistance.

Hi,
i've spent some time looking at the system activity, this is what i've noticed:

1)During normal activity
The only strange thing i noticed is  wmiprvse.exe making a lot of accesses to tzres.dll (the same 9 operations over and over). It doesn't affect the performance (a 4% cpu burst once in a while) so i can't really say whether this is new or it was already here before the CBS log problem.

2)During trustedInstaller and CBS log unwanted behaviour

The File System Activity and the Register Activity are full of entries from TrustedInstaller.exe, there are a lot of WriteFiles on CBS.log but also a lot of CreateFile (.mum) and register activity regarding windows updates. In the screenshot below, you can see activity around KB2685813 but it's not the only one. There are many KB... interested.

The most common string in TrustedInstaller.exe activity (beside CBS.log) is 31bf3856ad364e35.

I wish this someway helps you to understand the issue...otherwise, what should i look for?