Windows Update, SVCHOST, and 99% CPU usage... help please...

Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
wmiprvse.exe starts.
My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
time it happens. If I bootup later in the day, all's cool... only happens first bootup of
the day.
If I disable WU, all is cool.

The only connections that open are to windows update, during this lag.
As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.

I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
returned error: 4200."
In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
0x80041002."

Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
do nothing, then I have no problems.

I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
Right now, I have WU disabled, but I'd prefer to be notified when

Anyone have any idea what might be going on, or where I can look on my system to
troubleshoot this? Anywhere I can find out what is using SVCHOST?
Any help is appreciated... thanks!

For two weeks I have been experiencing the same CPU overload that Tiny Tim
and buFord have related to, it just dawned on me that it started when I
downloaded the "Microsoft Update" feature in lieu of 'Windows Update' site !
After all systems were booted up and stable [NAV, Zone Alarm, etc.] I have
had to wait as long as 4 minutes while SVCHost.exe robbed the CPU running at
70 to 75% usage all the while no other access was possible as total CPU Usage
was always 100% while SCVHost was running. Disabled the Microsoft/Windows
Update feature alltogether and success, I now have my PC back running the way
it used to ! ...NOW, is somebody going to wake up on the west coast out there
and fix this problem, or, shall we all just run our systems without knowing
if we are up todate with the latest patches, etc. ?? .........cheers;
McDoogie

"buRford" wrote:

> Hi - - Over the past month, I've noticed some strange behavior after my first bootup of
> the day... about 30 secs - a minute after bootup, wuauclt.exe starts, then shortly after
> wmiprvse.exe starts.
> My CPU spikes to 99%, and everything hangs. One entry of svchost spikes to
> 99% CPU usage. Then after 30 seconds or so, all goes back to normal. This is the only
> time it happens. If I bootup later in the day, all's cool... only happens first bootup of
> the day.
> If I disable WU, all is cool.
>
> The only connections that open are to windows update, during this lag.
> As far as I can tell, I've scanned with my AV (NOD32), Outpost Firewall anti-spyware
> plug-in, Spybot, Adaware, Spycop, and Unhackme... my system is clean.
>
> I don't know if this has any relevance: In my wmiprov.log I'll get an entry "WDM call
> returned error: 4200."
> In wbemess.log, I get five entries of "NT Event Log Consumer: could not retrieve sid,
> 0x80041002."
>
> Nothing abnormal shows up in the System or Application entries of EVENT VIEWER.
> No other abnormal behavior or errors ever... if I wait a minute or two after bootup, and
> do nothing, then I have no problems.
>
> I'm running XP sp2, on an AMD Athlon XP 1800, with 768MB RAM.
> Right now, I have WU disabled, but I'd prefer to be notified when
>
> Anyone have any idea what might be going on, or where I can look on my system to
> troubleshoot this? Anywhere I can find out what is using SVCHOST?
> Any help is appreciated... thanks!
>

kirk.mccann@gmail.com wrote:

> But here's the thing, an MVP has not come along and explained this.

Mainly because we don't have any idea what the problem is. None of the PCs
in my care exhibit any such problem, so I cannot investigate any further.

--
Robin Walker [MVP Networking]
rdhw@cam.ac.uk

Robin, your answer is a major cop out, this brings untold amounts of anger
and frustration to MS customers, the CPU usage thing, is basicly
UNACCEPTABLE, this indignation grates MS customers in a very BAD way.
Personally, I prefer to look in a multitude of sources ( usually find MS
solutions OUTSIDE of MS, thus life continues normally DESPITE MS and it's
self rightous indignation(S) !!

"Robin Walker [MVP]" wrote:

> kirk.mccann@gmail.com wrote:
>
> > But here's the thing, an MVP has not come along and explained this.
>
> Mainly because we don't have any idea what the problem is. None of the PCs
> in my care exhibit any such problem, so I cannot investigate any further.
>
> --
> Robin Walker [MVP Networking]
> rdhw@cam.ac.uk
>
>
>