Processor at 100%, no obvious cause

[Alain Dekker]

Hi,

I have a PC running Windows XP, SP3. When the computer starts, I load Task
manager, and get about 2 minutes of the process:
wmiprvse.exe
running at 100% CPU usage.

After about 2 minutes, that process goes to 0% and the only visible task
with a non-zero number (apart from occasionally rising to a few percent) is:
System Idle Process
which is what you expect, except that "CPU Usage" at the bottom of Task
Manager shows in the range of 80-90%. The CPU graph shows the same thing.

I have not attached JPG images of both, but have cpatured them showing the
above. Can email if it might clarify.

I don't know whats' going on here. Since no process is running at more than
a few percent, the overall CPU Usage should only be a few percent, but its
almost maxing the CPU. I figured it must be one of the several bits of
hardware I have attached (COM, Parallel ports, etc). I've tried disabling
several devices in Device Manager and rebooting, and still get the same
problem.

Any ideas, please?

Thanks,
Alain

 

[R. McCarty]

The proper diagnostic on boot issues is Event Viewer. Services are
highly interdependent. Some start only after others have completed.
The way Windows is designed a Service Start can wait as long as 30
seconds.

I would use EventVwr.Msc [Enter] and clear both System & App
logs and reboot. Then reopen EventVwr and examine both logs for
Red and Yellow icons that denote Errors and Warnings. This way
you are working with a single/complete boot sequence.

From your description it appears you have a case of incorrect Service
start modes.

 

[Gerry]

Alain

It could be associated with software checking for updates or malware.
What are your anti-virus and anti-spyware arrangements?

First CCleaner. This will help your system and reduce the time running
scans with Spybot S & D and Malwarebytes

An alternative to Disk CleanUp is cCleaner. It would be interesting to
know whether this has the same problem with central. dll? If it does
there is a feature, which I have not used, to excludes files which would
presumably enanable the process to complete.

cCleaner (freeware) which does a more thorough job than Disk CleanUp.
Disk CleanUp has to be run for each user profile, whereas cCleaner only
needs to be run once.
http://www.ccleaner.com/ccdownload.asp
http://www.ccleaner.com/

With any cleaner you need to proceed with caution. To be safe you
should create a restore point before using cCleaner. cCleaner also
offers backup before removal.

When using cCleaner think twice before checking Autocomplete Form
History under Internet Explorer. You do get a warning but this one has
irritating consequences. You may need to restore your system's
recollection of passwords after use so keep a record off computer so
that they can easily be re-entered.

I suggest you download and run Spybot S & D (freeware version). There
is a freeware version buried in this link:
http://www.safer-networking.org/en/spybotsd/index.html

Malwarebytes' Anti-Malware
1.36 -freeware (if you upgrade you pay).
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

Run Malwarebytes' in safe mode and turn off your current anti-virus
before you do to avoid a conflict. Disregard the invitation on the web
site regarding the Registry Optimiser -a Registry Optimiser is not a
helpful utility.

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[John McGaw]

Hi,

I have a PC running Windows XP, SP3. When the computer starts, I load Task
manager, and get about 2 minutes of the process:
wmiprvse.exe
running at 100% CPU usage.

snip...

Do you have "Show processes from all users" checked? It might well be that
some other user is eating CPU cycles.

 

[Alain Dekker]

Thanks for that answer.

The PC is a dedicated touchscreen going into a machine not intended to be
connected to the internet. Its straight "out-of-the-box" from our supplier
(ie. brand new). We replaced the PC with another in stock (which should in
theory be exactly the same - same hardware, same XP clone, same services,
etc) and that one worked perfectly.

There is therefore no anti-virus/spamware installed (at this stage - might
be later on).

Thanks,
Alain

 

[Alain Dekker]

Thanks for that answer.

The PC is a dedicated touchscreen going into a machine not intended to be
connected to the internet. Its straight "out-of-the-box" from our supplier
(ie. brand new). We replaced the PC with another in stock (which should in
theory be exactly the same - same hardware, same XP clone, same services,
etc) and that one worked perfectly.

I'll be checking the Event log shortly. Thanks for that idea.

Thanks,
Alain

The proper diagnostic on boot issues is Event Viewer. Services are
highly interdependent. Some start only after others have completed.
The way Windows is designed a Service Start can wait as long as 30
seconds.

I would use EventVwr.Msc [Enter] and clear both System & App
logs and reboot. Then reopen EventVwr and examine both logs for
Red and Yellow icons that denote Errors and Warnings. This way
you are working with a single/complete boot sequence.

From your description it appears you have a case of incorrect Service
start modes.

Hi,

I have a PC running Windows XP, SP3. When the computer starts, I load
Task
manager, and get about 2 minutes of the process:
wmiprvse.exe
running at 100% CPU usage.

After about 2 minutes, that process goes to 0% and the only visible task
with a non-zero number (apart from occasionally rising to a few percent)
is:
System Idle Process
which is what you expect, except that "CPU Usage" at the bottom of Task
Manager shows in the range of 80-90%. The CPU graph shows the same thing.

I have not attached JPG images of both, but have cpatured them showing
the above. Can email if it might clarify.

I don't know whats' going on here. Since no process is running at more
than
a few percent, the overall CPU Usage should only be a few percent, but
its
almost maxing the CPU. I figured it must be one of the several bits of
hardware I have attached (COM, Parallel ports, etc). I've tried disabling
several devices in Device Manager and rebooting, and still get the same
problem.

Any ideas, please?

Thanks,
Alain

 

[Alain Dekker]

Thanks, good idea, but unfortunately I can't see how that is relevant. Its a
bran new machine "out-of-the-box" and there are no other users connected the
PC (nor even defined). The active user is an Administrator, don't know if
thats relevant.

I will go and specifically check that, though, thanks.

Alain

 

[Alain Dekker]

Right have checked this, and there's absolutely no change in what Task
Manager shows me when I check the "Show processes from all users" box.

Another thing I will note that is that the current Thread count and I/O
Read/Write count for all active processes hardly changes, yet the CPU usage
is varying constantly between about 65% to about 95%.

Thanks,
Alain

 

[Alain Dekker]

OK, I've done what you suggested. Nothing too radical to report. These are
the 3 "Warning" events I get in the System log - nothing of interest to
report in the Application or other logs:

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.104.213 will be assigned to dial-in clients. Clients may be unable
to access resources on the network.

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.134.244 will be assigned to dial-in clients. Clients may be unable
to access resources on the network.

ID=20192, 15:14:23
A certificate could not be found. Connections that use the L2TP protocol
over IPSec require the installation of a machine certificate, also known as
a computer certificate. No L2TP calls will be accepted.

As the computer is not connected to the network (and therefore not to a DHCP
server) I don't find anything too surprising except that two private IP
addresses are mentioned. Note I don't that this is just a boot issue...after
booting up, the processor continues to run at ~80%.

Thanks,
Alain

The proper diagnostic on boot issues is Event Viewer. Services are
highly interdependent. Some start only after others have completed.
The way Windows is designed a Service Start can wait as long as 30
seconds.

I would use EventVwr.Msc [Enter] and clear both System & App
logs and reboot. Then reopen EventVwr and examine both logs for
Red and Yellow icons that denote Errors and Warnings. This way
you are working with a single/complete boot sequence.

From your description it appears you have a case of incorrect Service
start modes.

Hi,

I have a PC running Windows XP, SP3. When the computer starts, I load
Task
manager, and get about 2 minutes of the process:
wmiprvse.exe
running at 100% CPU usage.

After about 2 minutes, that process goes to 0% and the only visible task
with a non-zero number (apart from occasionally rising to a few percent)
is:
System Idle Process
which is what you expect, except that "CPU Usage" at the bottom of Task
Manager shows in the range of 80-90%. The CPU graph shows the same thing.

I have not attached JPG images of both, but have cpatured them showing
the above. Can email if it might clarify.

I don't know whats' going on here. Since no process is running at more
than
a few percent, the overall CPU Usage should only be a few percent, but
its
almost maxing the CPU. I figured it must be one of the several bits of
hardware I have attached (COM, Parallel ports, etc). I've tried disabling
several devices in Device Manager and rebooting, and still get the same
problem.

Any ideas, please?

Thanks,
Alain

 

[JS]

It could be a sub-process or application that's running in the background
and taking all the CPU resources.

To find and display what could be the problem try Process Explorer:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Store the downloaded file (It's in a Zip format) onto a USB stick
or burn to a DVD.

Once you have Process Explorer installed and running:
In the taskbar select View and check:
'Show Process Tree' and the 'Show Lower Pane' options.
Move your mouse cursor over any column in the right hand pane and
right click and check the following boxes:
'Command Line' and 'Version'.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU usage.
Next click on the CPU column to sort the processes by %CPU usage
(Highest to Lowest).

Move the mouse cursor over any process,
you should see a popup with some detailed info.
Then mouse over the process that's using most or all the CPU %.
Then click on that process to highlight it,
Now that it's highlighted, right click and from the options listed select:
'Search Online'. (Since your not connected this does not apply)
This should display what out there on the web about that process.

You can also double click on any process to open up a more detailed
'Properties' window.
Note: some entries like Explorer, System/Services, and Svchost
may need to be expanded to show the detail (sub processes),
in this case click on the + located to the left of the entry.

An alternate method when using Process Explorer
is to double click on the Graph just below the Menu bar.
This will open the 'System Information' window, which has a larger display
of all three graphs. Move your mouse over any spike in the
CPU Usage graph to see what process/application or service is the cause
of the spike.

 

[R. McCarty]

Thanks for the updated info. If the PC is not on a network is it connected
to the Internet at all ? If not then I'd either disabled the Ethernet NIC or
unbind the Protocols/Services from it. Part of your bootup issue is going
to be the time lag for NIC initialization. That's why it eventually obtains
the
"Autoconfiguration" address starting with 169.x.x.x

OK, I've done what you suggested. Nothing too radical to report. These are
the 3 "Warning" events I get in the System log - nothing of interest to
report in the Application or other logs:

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.104.213 will be assigned to dial-in clients. Clients may be unable
to access resources on the network.

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.134.244 will be assigned to dial-in clients. Clients may be unable
to access resources on the network.

ID=20192, 15:14:23
A certificate could not be found. Connections that use the L2TP protocol
over IPSec require the installation of a machine certificate, also known
as a computer certificate. No L2TP calls will be accepted.

As the computer is not connected to the network (and therefore not to a
DHCP server) I don't find anything too surprising except that two private
IP addresses are mentioned. Note I don't that this is just a boot
issue...after booting up, the processor continues to run at ~80%.

Thanks,
Alain

The proper diagnostic on boot issues is Event Viewer. Services are
highly interdependent. Some start only after others have completed.
The way Windows is designed a Service Start can wait as long as 30
seconds.

I would use EventVwr.Msc [Enter] and clear both System & App
logs and reboot. Then reopen EventVwr and examine both logs for
Red and Yellow icons that denote Errors and Warnings. This way
you are working with a single/complete boot sequence.

From your description it appears you have a case of incorrect Service
start modes.

Hi,

I have a PC running Windows XP, SP3. When the computer starts, I load
Task
manager, and get about 2 minutes of the process:
wmiprvse.exe
running at 100% CPU usage.

After about 2 minutes, that process goes to 0% and the only visible task
with a non-zero number (apart from occasionally rising to a few percent)
is:
System Idle Process
which is what you expect, except that "CPU Usage" at the bottom of Task
Manager shows in the range of 80-90%. The CPU graph shows the same
thing.

I have not attached JPG images of both, but have cpatured them showing
the above. Can email if it might clarify.

I don't know whats' going on here. Since no process is running at more
than
a few percent, the overall CPU Usage should only be a few percent, but
its
almost maxing the CPU. I figured it must be one of the several bits of
hardware I have attached (COM, Parallel ports, etc). I've tried
disabling
several devices in Device Manager and rebooting, and still get the same
problem.

Any ideas, please?

Thanks,
Alain

 

[Bob Harris]

This file is part of XP itself, so in some sense the slowdown is a "feature"
of XP.

I had a similar problem about a year and a half ago. The best I could do
was drop the priority of the task using "process explorer", which is free
from Microsoft at
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx From the
main window, right-click on any process to get a menu, which includes set
priority.

However, some time in the last year or so, this problem fixed itself. That
might have been due to installing SP-3 and/or some associate update via
windows update.

Searching the web for "wmiprvse.exe" also suggests that updating device
drivers might help. Windows update will show some newer drivers, if they
are available. But, not all drivers are available via windows update. So,
check the support website of your motherboard, video card, etc.

 

[Gerry]

Alain

The service Windows Management Instrumentation has the Security Center
and the Windows Firewall dependent on the service. You might try
changing the startup type to manual. I am not sure affect it will have.

Select Start, Control Panel, Administrative Tools, Services and right
click on Windows Management Instrumentation and select Properties. The
StartUp type
should be Automatic. Changing to Manual using the scroll bar to the
right of Automatic may help.

The problem with no internet connection is most applications expect to
connect to the internet to update and regularly check to see what
updates are available. The most obvious is Windows Automatic updates. It
may be preferable to disable Automatic Updates first before making the
change to Windows Management Instrumentation . Start, Control Panel,
Automatic Updates.

JS has suggested Process Explorer. This is my standard response for
Process Explorer. Given no internet access you will need to download to
another computer and transfer the programme.

Download Process Explorer.
For further information about Process Explorer see here:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

It would be helpful if you could post the Command Line of the process
generating the excessive CPU usage. In Process Explorer place
cursor on Process and select Properties, Image.

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Alain Dekker]

The computer isn't connected now, but might be in future.

This doesn't appear to be the problem because even after 30 minutes after
bootup, the processor is STILL running at 80%-ish...

Regards,
Alain

Thanks for the updated info. If the PC is not on a network is it connected
to the Internet at all ? If not then I'd either disabled the Ethernet NIC
or
unbind the Protocols/Services from it. Part of your bootup issue is going
to be the time lag for NIC initialization. That's why it eventually
obtains the
"Autoconfiguration" address starting with 169.x.x.x

OK, I've done what you suggested. Nothing too radical to report. These
are the 3 "Warning" events I get in the System log - nothing of interest
to report in the Application or other logs:

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.104.213 will be assigned to dial-in clients. Clients may be
unable to access resources on the network.

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.134.244 will be assigned to dial-in clients. Clients may be
unable to access resources on the network.

ID=20192, 15:14:23
A certificate could not be found. Connections that use the L2TP protocol
over IPSec require the installation of a machine certificate, also known
as a computer certificate. No L2TP calls will be accepted.

As the computer is not connected to the network (and therefore not to a
DHCP server) I don't find anything too surprising except that two private
IP addresses are mentioned. Note I don't that this is just a boot
issue...after booting up, the processor continues to run at ~80%.

Thanks,
Alain

The proper diagnostic on boot issues is Event Viewer. Services are
highly interdependent. Some start only after others have completed.
The way Windows is designed a Service Start can wait as long as 30
seconds.

I would use EventVwr.Msc [Enter] and clear both System & App
logs and reboot. Then reopen EventVwr and examine both logs for
Red and Yellow icons that denote Errors and Warnings. This way
you are working with a single/complete boot sequence.

From your description it appears you have a case of incorrect Service
start modes.

Hi,

I have a PC running Windows XP, SP3. When the computer starts, I load
Task
manager, and get about 2 minutes of the process:
wmiprvse.exe
running at 100% CPU usage.

After about 2 minutes, that process goes to 0% and the only visible
task
with a non-zero number (apart from occasionally rising to a few
percent) is:
System Idle Process
which is what you expect, except that "CPU Usage" at the bottom of Task
Manager shows in the range of 80-90%. The CPU graph shows the same
thing.

I have not attached JPG images of both, but have cpatured them showing
the above. Can email if it might clarify.

I don't know whats' going on here. Since no process is running at more
than
a few percent, the overall CPU Usage should only be a few percent, but
its
almost maxing the CPU. I figured it must be one of the several bits of
hardware I have attached (COM, Parallel ports, etc). I've tried
disabling
several devices in Device Manager and rebooting, and still get the same
problem.

Any ideas, please?

Thanks,
Alain

 

[Alain Dekker]

OK, tried putting WMI to Manual (I'm a software developer do I know how to
change that), no help.

I do have some information from Process Explorer, though (great suggestion,
thanks). The first two lines immediately tell me the problem (but not the
cause):

Process PID CPU Description Company Name
System Idle Process 0 18.18
Interrupts n/a 80.30 Hardware Interrupts

For some reason my system is spending a HUGE amount on time on "Hardware
Interrupts". I've checked Device Manager and everything looks kosher. Also,
this system is just one of many which are (supposed to be) identical,
hardware and software-wise.

Any idea how I find out what is causing the "Hardware Interrupts"?

Thanks,
Alain

 

[Alain Dekker]

I do have some information from Process Explorer, (great suggestion,
thanks). The first two lines immediately tell me the problem (but not the
cause):

Process PID CPU Description Company Name
System Idle Process 0 18.18
Interrupts n/a 80.30 Hardware Interrupts

For some reason my system is spending a HUGE amount on time on "Hardware
Interrupts". I've checked Device Manager and everything looks kosher. Also,
this system is just one of many which are (supposed to be) identical,
hardware and software-wise.

Any idea how I find out what is causing the "Hardware Interrupts"?

Thanks,
Alain

 

[Alain Dekker]

Don't think its wmiprvse.exe causing the problem - I've confirmed its in the
correct location, has the correct Windows signatures and besides after 30
minutes the processor is still hanging around 80+%.

I do have some information from Process Explorer, though (great suggestion,
thanks). The first two lines immediately tell me the problem (but not the
cause):

Process PID CPU Description Company Name
System Idle Process 0 18.18
Interrupts n/a 80.30 Hardware Interrupts

For some reason my system is spending a HUGE amount on time on "Hardware
Interrupts". I've checked Device Manager and everything looks kosher. Also,
this system is just one of many which are (supposed to be) identical,
hardware and software-wise.

Any idea how I find out what is causing the "Hardware Interrupts"?

Thanks,
Alain

 

[R. McCarty]

Even though the computer is not Internet connected could this activity
be related to Windows/Microsoft Update ? It generally tries to run at
boot to check for new updates. I might try disabling the service and
boot and compare times.

The computer isn't connected now, but might be in future.

This doesn't appear to be the problem because even after 30 minutes after
bootup, the processor is STILL running at 80%-ish...

Regards,
Alain

Thanks for the updated info. If the PC is not on a network is it
connected
to the Internet at all ? If not then I'd either disabled the Ethernet NIC
or
unbind the Protocols/Services from it. Part of your bootup issue is going
to be the time lag for NIC initialization. That's why it eventually
obtains the
"Autoconfiguration" address starting with 169.x.x.x

OK, I've done what you suggested. Nothing too radical to report. These
are the 3 "Warning" events I get in the System log - nothing of interest
to report in the Application or other logs:

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.104.213 will be assigned to dial-in clients. Clients may be
unable to access resources on the network.

ID=20169, 15:14:17
Unable to contact a DHCP server. The Automatic Private IP Address
169.254.134.244 will be assigned to dial-in clients. Clients may be
unable to access resources on the network.

ID=20192, 15:14:23
A certificate could not be found. Connections that use the L2TP protocol
over IPSec require the installation of a machine certificate, also
known as a computer certificate. No L2TP calls will be accepted.

As the computer is not connected to the network (and therefore not to a
DHCP server) I don't find anything too surprising except that two
private IP addresses are mentioned. Note I don't that this is just a
boot issue...after booting up, the processor continues to run at ~80%.

Thanks,
Alain

The proper diagnostic on boot issues is Event Viewer. Services are
highly interdependent. Some start only after others have completed.
The way Windows is designed a Service Start can wait as long as 30
seconds.

I would use EventVwr.Msc [Enter] and clear both System & App
logs and reboot. Then reopen EventVwr and examine both logs for
Red and Yellow icons that denote Errors and Warnings. This way
you are working with a single/complete boot sequence.

From your description it appears you have a case of incorrect Service
start modes.

Hi,

I have a PC running Windows XP, SP3. When the computer starts, I load
Task
manager, and get about 2 minutes of the process:
wmiprvse.exe
running at 100% CPU usage.

After about 2 minutes, that process goes to 0% and the only visible
task
with a non-zero number (apart from occasionally rising to a few
percent) is:
System Idle Process
which is what you expect, except that "CPU Usage" at the bottom of
Task
Manager shows in the range of 80-90%. The CPU graph shows the same
thing.

I have not attached JPG images of both, but have cpatured them showing
the above. Can email if it might clarify.

I don't know whats' going on here. Since no process is running at more
than
a few percent, the overall CPU Usage should only be a few percent, but
its
almost maxing the CPU. I figured it must be one of the several bits of
hardware I have attached (COM, Parallel ports, etc). I've tried
disabling
several devices in Device Manager and rebooting, and still get the
same
problem.

Any ideas, please?

Thanks,
Alain

 

[Alain Dekker]

Thats an excellent suggestion, thanks. Process Explorer has shown me this
something called "Hardware Interrupts" is chewing the processor. Could
MSConfig find the culprit?

Thanks,
Alain

 

[Jim]

Don't think its wmiprvse.exe causing the problem - I've confirmed its in
the correct location, has the correct Windows signatures and besides after
30 minutes the processor is still hanging around 80+%.

I do have some information from Process Explorer, though (great
suggestion, thanks). The first two lines immediately tell me the problem
(but not the cause):

Process PID CPU Description Company Name
System Idle Process 0 18.18
Interrupts n/a 80.30 Hardware Interrupts

For some reason my system is spending a HUGE amount on time on "Hardware
Interrupts". I've checked Device Manager and everything looks kosher.
Also, this system is just one of many which are (supposed to be)
identical, hardware and software-wise.

Any idea how I find out what is causing the "Hardware Interrupts"?

Thanks,
Alain

There is a problem somewhere with one or more of your drivers. Finding out
which one can be time consuming, even then the real cause of the trouble may
not be obvious.
There might not be anything wrong with the drivers; instead, you might have
a hardware problem that the system is trying mightly to resolve.
What I would do is to remove all devices that are not needed to run the
computer. That is, everything except the mouse, the keyboard, the system
drive, and the monitor.
Then check again for interrupt service time.
What you do next depends on what the interrupt service time reveals.
Jim