99% CPU usage after bootup??

[buRford]

Hi - - Over the past month, I've noticed some strange behavior after bootup...
about 30 secs - a minute after bootup, wuauclt.exe, then wmiprvse.exe start.
Shortly after my CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
time it happens.
The only connections that open are to windows update, during this lag.
As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.

In my wmiprov.log I'll get an entry "WDM call returned error: 4200."
In wbemess.log, I get a bunch of "NT Event Log Consumer: could not retrieve sid,
0x80041002." ... and also, "Failed to log an event: 1F, "Failed to log an event: 6B5,"
"Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log
Consumer" in namespace //./root/subscription," "Failed to deliver an event to event
consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001."
Nothing abnormal shows up in the System or Application entries of event viewer.
No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
do nothing, then I have no problems.

I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.

Anyone have any idea what might be going on, or where I can look on my system to
troubleshoot this?
Any help is appreciated... thanks!

 

[Gerry Cornell]

Post full copies of the Report in the order they appear in the System log
after booting start. Disregard Information Reports. Just the first three or
four is enough.

You can access Event Viewer by selecting Start, Administrative Tools,
Event Viewer. When researching the meaning of the error, information
regarding Event ID, Source and Description are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[buRford]

Post full copies of the Report in the order they appear in the System log
after booting start. Disregard Information Reports. Just the first three or
four is enough.

You can access Event Viewer by selecting Start, Administrative Tools,
Event Viewer. When researching the meaning of the error, information
regarding Event ID, Source and Description are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.

As I said in my initial post, there are no errors in the event viewer log... only in the
wmiprov.log... and wbemess.log.
I don't even know if those errors are related to the hanging.

Any other help is appreciated