IV81302: AFTER BIGFIX AGENT IS INSTALLED TRUSTEDINSTALLER.EXE CAUSES CPU SPIKES.

APAR status

• Closed as fixed if next.

Error description

• Bigfix Agent Installation on Windows OSs creates the following
  register keys that may trigger a windows update
  causing CPU spikes during agent startup.
  
  HKEY_CLASSES_ROOT\Wow6432Node(if 64
  bit)\CLSID\{E309D76C-30B0-475F-8768-F7FD17840411}\Inprocserver32
  HKEY_CLASSES_ROOT\Wow6432Node(if 64
  bit)\CLSID\{8B5C384B-7652-4BA9-9D00-BE3F8BB9BFA2}\Inprocserver32
  HKEY_CLASSES_ROOT\Wow6432Node(if 64
  bit)\CLSID\{8B040734-3C5D-42CD-93C3-3C7E945EE6D3}\Inprocserver32
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node(if 64
  bit)\Classes\CLSID\{8B040734-3C5D-42CD-93C3-3C7E945EE6D3}\Inproc
  Server32
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node(if 64
  bit)\Classes\CLSID\{8B5C384B-7652-4BA9-9D00-BE3F8BB9BFA2}\Inproc
  Server32
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node(if 64
  bit)\Classes\CLSID\{E309D76C-30B0-475F-8768-F7FD17840411}\Inproc
  Server32
  
  Inside Agent YYYYMMDD.log you may see multiple sequences like:
  
  0:14:22 -0700 - Patching Support
  (http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport)
  
     Fixed - Task: Windows Update Service - Start the service
  (fixlet:12003)
  
  At 10:14:23 -0700 -
  
     Report posted successfully
  
  At 10:14:23 -0700 - Patching Support
  (http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport)
  
     Relevant - Task: Windows Update Service - Stop the service
  (fixlet:12004)
  

Local fix

• The workaround is to open the following 6 registry keys:
  
  HKEY_CLASSES_ROOT\Wow6432Node(if 64
  bit)\CLSID\{E309D76C-30B0-475F-8768-F7FD17840411}\Inprocserver32
  HKEY_CLASSES_ROOT\Wow6432Node(if 64
  bit)\CLSID\{8B5C384B-7652-4BA9-9D00-BE3F8BB9BFA2}\Inprocserver32
  HKEY_CLASSES_ROOT\Wow6432Node(if 64
  bit)\CLSID\{8B040734-3C5D-42CD-93C3-3C7E945EE6D3}\Inprocserver32
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node(if 64
  bit)\Classes\CLSID\{8B040734-3C5D-42CD-93C3-3C7E945EE6D3}\Inproc
  Server32
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node(if 64
  bit)\Classes\CLSID\{8B5C384B-7652-4BA9-9D00-BE3F8BB9BFA2}\Inproc
  Server32
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node(if 64
  bit)\Classes\CLSID\{E309D76C-30B0-475F-8768-F7FD17840411}\Inproc
  Server32
  
  
  and delete the encrypted value of each sub key InprocServer32
  under each above registry key.
  Meaning delete the encrypted string under subkey InprocServer32
  under HKEY_CLASSES_ROOT\Wow6432Node(if 64
  bit)\CLSID\{E309D76C-30B0-475F-8768-F7FD17840411}\Inprocserver32
  
  and so on.
  
  Then reboot the workstation .
  

Problem summary

• The fix for this APAR will be included in the next BigFix 9.5
  release.
  General availability 1H 2016 (release schedule subject to
  change).
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• R92W PSN

     UP