Fix: makecab.exe running at Startup

You will be reading this article if you have noticed the process ‘makecab.exe’ running at either your startup or at different intervals throughout your session. This process is known to have irregular patterns and consumes a lot of resources (CPU/Memory). Although this process is linked to some virus in several cases; it is a legitimate process used by Windows operating system.

The ‘makecab.exe’ program is used to compress CBS log files which can be large files. This is done so the CBS files don’t consume much disk space on your computer. These CBS log files can be huge files (~20GB in some cases) if they are not compressed by the process. This unusual behavior is usually spawned when there is a failed Windows update on your computer. When Windows scans for updates upon boot, it often finds these CBS log files and tries to compress them using the process under discussion.

Normally, the frequent running of the process is normal. If the process launches at your startup or at regular intervals but disappears in a while, don’t bother with the solution. This is quite normal behavior. However, if you get increased usage of the process makecab.exe, you should continue with the rest of the article.

Solution: Deleting the Log File or Identifying the Parent Process

Normally this issue is resolved after deleting the Log file due to which Windows is acting in this unusual behavior. Before you proceed with deleting the log file, it is worthwhile to open the process monitor and check what the parent process is which is running the executable.

Process Explorer is a tool by Microsoft which shows you information regarding which DLL’s have been opened/loaded along with all the details about which parent process started it. It gives you information regarding the resources consumed, CPU usage etc. We can try checking for processes using DCOM and troubleshoot why they are using it.

1. Download Process Explorer from the official Microsoft website.
2. Once you have unzipped the package in an accessible directory, launch it. You will be greeted by a number of processes along with their details. Click on “File” at the top left and select “Show Details for All Processes”. You might require administrator privileges to perform this operation

3. Now locate the process “makecab.exe”, right-click it and select Properties. Navigate to the Image tab. Here you will see the culprit i.e. which process is using the executable.

4. Do a little digging and locate the application/service. You can easily disable as service using “services.msc” or uninstall an application.

If you cannot find any parent processes which is running the executable on your computer, you should navigate to the directory where all the logs are found and delete the log files. You can even copy them to another location and rename them if you don’t feel comfortable deleting the files.

1. Press Windows + E to launch the File Explorer and navigate to the following address:

C:\Windows\Logs\CBS

2. Delete the log files present and restart your computer. Hopefully, the problem at hand will be solved instantly.

If you still notice high CPU usage or frequent running of the process when you start your computer or at regular intervals, consider scanning your computer thoroughly. Like we mentioned at the start, there are also some malware or virus which disguise themselves as the process.