is 80% CPU normal if Rundll32 handles/runs Software Protection service?, when Rundll32 started running i went in even logs to see what process is using Rundll32 & i got this
Step 1
The Software Protection service is starting.
Parameters:caller=wmiprvse.exe
Step 2
Initialization status for service objects.
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
Step 3
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 0cdc4d08-6df6-4eb4-b5b4-a373c3e351e7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 625cc89b-693d-45c4-9967-123877fc41e4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 9a8645c4-8908-49bb-8eec-6671a533b17a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 9e263fcf-ef40-428c-8aa1-40e09e2994db, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 9e4b231b-3e45-41f4-967f-c914f178b6ac, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: b080aea2-e6c5-4b22-838e-fa4a21c931e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: bbc56067-37f8-49dd-87b2-a418a9ba130a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: bf4b3af6-c071-496d-bfcc-5f0dc12c7798, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: c752c2e0-7c17-4af4-bba6-6f8aa1e698bc, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c7c00280-b24d-4e82-89ca-4f1288eb1d9e, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )]
11: fe1c3238-432a-43a1-8e25-97e7d1ef10f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
Step 4
The Software Protection service has started.
6.3.9600.16497
Step 5
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: c7c00280-b24d-4e82-89ca-4f1288eb1d9e, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )]
Step 6
Successfully scheduled Software Protection service for re-start at 2115-03-12T22:55:16Z. Reason: RulesEngine.
Finale
The Software Protection service has stopped.
i explained it by steps cause when 1 finishes next1 starts
this events make 1 big event, they are all Software Protection service, & its runs awry day once a day, some times its just 4event 1 after another, 4 first steps & sometimes there is 2, 1 say's started & other say's finished or complete, but the 2 are meany
Hours before the first 4, or all the 6 above
there are few Software Protection service events more that work in different time & before the event above, it can be hours before
Successfully scheduled Software Protection service for re-start at 2115-03-12T18:29:03Z. Reason: RulesEngine.
&
The Software Protection service has stopped
the 2 events also work 1 right after another, when 1 stops other1 starts, i mean they are 1 event
this is the only time Rundll32 takes so much CPU, also i think its the only time i ever see Rundll32 run when The Software Protection service is running, Software Protection is not running in taksmanager so i take Rundll32 as Software Protection Service.exe
cause it runs Software Protection service
EDIT:
My bad total memory was 80%, Win 8 show it a bit differently, the memory stuff, rundll32 it self was a bit over 60% or 70%, my question is it normal