locked
Event ID 10 error every boot

    Question

  • Every boot or reset, I get the following message in the Admin Events of Event Viewer.  It would seem many others are having the same error, yet there is no obvious solution

    >>
    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
    >>

    The event Log Online Help reports many with the same problem, no solution other than to report it on this forum, so help appreciated

    Kotuku
    Sunday, October 12, 2008 5:49 PM

Answers

  • Just to put some of the FUD to rest...  There is a simple answer to this.

    http://support.microsoft.com/kb/950375

    "This problem occurs if the WMI filter is accessed without sufficient permission."

    In our case, I believe a network inventory program is making WMI calls on a regular basis, and is being denied.  YMMV.

    Ethan
    Tuesday, March 03, 2009 9:08 PM
  • Found this solution tonight, thought you would like to try it.... I fix my problem, Windows Vista 64 Bit ultimate is now stable and clean.

     

    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected

     

    The error above is cause by two Root Worms!  here are their names:  Tok-Currhatus-1233 and Bron-Spizaetus, their is also an unknown Root kit Called "Empty"

     

    I was experiencing the same issues, here is a way to test to see if infected, by the way virus scanner will not detect this root kits....

     

     

    1. In the search bar, of windows Vista typ MSCONFIG, if infected the system will shutdown and restart.

     

    2. Try to download any Windows updates, system will shutdown and restart. 

     

    Solution

     

    1. Start your system in Safe Mode with Networking.

    2. run MSConfig

    3. In the Startup tab, Disable  Tok-Cirrhatus, Bron-spizaetus, Empty and nay other startup system that it is not recognized, (Hint, type the name in google and it will tell you what it is)

    4.  run virus scanner and remove the Root Worm's

     

     

    Restart and system is now clean.

     

    If this does not work, let us know, and we will try to identify further problems.

     

    Contact at:  rgarcia@softwaresolutioncorp.com

     

    Wednesday, October 15, 2008 3:51 AM

All replies

  • Vista Ultimate Problem (All 64Bit Vista Systems have this problem, 32 bit systems exempt)

     

    The problem is due to 32 bit application running on a 64 Bit system, is creating an overflow.

     

    Microsoft has not yet created a fix, for this issue, but it will cause me to deploy only 32 Bit Vista into production...

     

    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
    Wednesday, October 15, 2008 1:08 AM
  • Found this solution tonight, thought you would like to try it.... I fix my problem, Windows Vista 64 Bit ultimate is now stable and clean.

     

    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected

     

    The error above is cause by two Root Worms!  here are their names:  Tok-Currhatus-1233 and Bron-Spizaetus, their is also an unknown Root kit Called "Empty"

     

    I was experiencing the same issues, here is a way to test to see if infected, by the way virus scanner will not detect this root kits....

     

     

    1. In the search bar, of windows Vista typ MSCONFIG, if infected the system will shutdown and restart.

     

    2. Try to download any Windows updates, system will shutdown and restart. 

     

    Solution

     

    1. Start your system in Safe Mode with Networking.

    2. run MSConfig

    3. In the Startup tab, Disable  Tok-Cirrhatus, Bron-spizaetus, Empty and nay other startup system that it is not recognized, (Hint, type the name in google and it will tell you what it is)

    4.  run virus scanner and remove the Root Worm's

     

     

    Restart and system is now clean.

     

    If this does not work, let us know, and we will try to identify further problems.

     

    Contact at:  rgarcia@softwaresolutioncorp.com

     

    Wednesday, October 15, 2008 3:51 AM
  • Nope, that sure as heck isn't my cause of problem, I would know if I had worms or other nasties!

    But thanks for the try.

    Kotuku

    Wednesday, October 15, 2008 3:59 AM
  • This is ridiculous. Brand new system with 64bit os/4gb ram/vista ultimate installed on dell latitude 6500.
    Afetr the PC completly crashed from a windows update (do nto install power toys!!!!!!), i reinstalled the whole OS from tyhe DVD. It says it format the drive...it does not and create a windows.old folder...this is stupid!
    I am now running vista with the updates disabled...(stupid again) and have a blue screen of death and cold restart each time the PC is iddle for 20 min.
    I am a business user and this so far cost me a week worth of work...i am really pissed off with Microsoftand as IT manager of a big company, i will do my best to move away from microsoft and make sure we move towards linux .
    Microsfot support has been absolutly ridiculous...
    If anyone has a fix for it please share..having to rely on forums to sort out the issues should not be the wayforward when you pay full price.
    AAAAAAAAAAAAAAAARRRRRRRRRRRGGGGGGGGGGGGGGGHHHHHHHHHHHHHHHHHHHHHHHH
    Monday, October 20, 2008 8:46 PM
  • I am the Original Poster for this Event ID 10.  While I get it every boot-up, it is not causing any problems, just an annoyance.

    Firstly Power Toys is not something you can blame MS about!  You use those unsupported utilities at your own peril!

    Why on earth didn't you return your new machine to Dell for them to fix it?  I think ALL Dell's have a full guarantee and at least a restore to original condition that you bought it as.  If you still have problems, I suggest you use the Dell Restore and start again!

    If in your repair you asked it to format the drive, then it will have done it or given you an error message as to why it didn't.

    The Windows.old is just a back-up of your programs and data.  You can't run anything freom that folder, you have to reinstall the programs and move your data from the .old to the new installed program.

    Kotuku

    Monday, October 20, 2008 9:08 PM
  • Then this update should not come in the automatic updates...should it???
    Did not send the machine back...because i work on it!!! Sending it would have cost 3 days of work...not a chance, quicker to format and reinstall.
    If you post to say nothing...then don't post!

    Tuesday, October 21, 2008 5:51 AM
  • Just to put some of the FUD to rest...  There is a simple answer to this.

    http://support.microsoft.com/kb/950375

    "This problem occurs if the WMI filter is accessed without sufficient permission."

    In our case, I believe a network inventory program is making WMI calls on a regular basis, and is being denied.  YMMV.

    Ethan
    Tuesday, March 03, 2009 9:08 PM
  • I have the same WMI event, and is followed by BSOD, I am almost sure mine started with a Windows Defender update.

    Tried running VBS script mentioned on above kb article (kb950375), but when I run it I get this error;

    Script C:\Users\...\...\test.vbs
    Line: 18
    Char: 17
    Error: Access denied
    Code: 80041003
    Source: SWbemObjectEx

    Kevin
    Tuesday, April 28, 2009 9:55 AM
  • I get the same problem as kbevington. any solution?
    Friday, June 12, 2009 10:44 AM
  • I get the same problem as kbevington. any solution?
    My issue ended up being a problem with the memory.
    I ended up re-formatting drive, and re-installing Vista. Within 12 hours or so I was having the exact same issue again. I replaced the memory, re-formatted, re-installed Vista, and have not had a problem since.

    Good Luck
    Friday, June 12, 2009 11:33 AM
  • thanks.

    I started getting multiple BSOD a week ago. Event manager was getting very busy! I went back to a previous back up image I had taken but it still continued. Removed some apps but still continued. I have since found out it may have been cuased by an antivirus app I had - which I have remvoed - which apprently does not totally remove itself. My last BSOD had a .sys file related to the software as the possible cuase - as seen in the dmp file. On googling, others had faed the same type of problems. Someone had written a script to remove the antivirus app  from everywhere. Ran that - took a while - and, touch wood, my laptop has now run for 3 hours with no BSOD. Its a new record over the last week.

    Still not sure it is resolved but at least I can use my laptop for more than 45-60mins without a BSOD.
     
    I still get the error above but it seems it is not the cause or symptom of my main problem.

    Friday, June 12, 2009 12:01 PM
  • You should run this in safe mode as suggested in the article.
    Friday, August 14, 2009 7:21 AM
  • This definately not a rootkit if you can disable it with MSConfig. It's rated as a virus/worm. The proper way to resolve the eventid 10 issue is the MS KB that has been suggested already!
    Friday, August 14, 2009 7:24 AM
  • Just to add some feedback, i had exactly the same problems as listed in the first post.

    After trying lots of things the following worked for me......I used the microsoft fix above kb950375, but it did nothing until i turned off uca.

    Then it seemed to only remove the log entries, because after a reboot, i had the same problem back....event 10, at random, about 5 a day, and the laptop would shut down and restart.

    This first appeared after installing service pack 1 for vista , whilst updating a new laptop.

    They way i have resolved this, and it has worked, was to download service pack 2 for vista.

    Since then......no more event 10s and a clean running laptop.


    I hope this has helped anyone..........

    Oh.....one for microsoft.....not that you will take note.......when you produce an operating system.....or an update......make sure it works properly.....before you feed it to the peasants out here in the big wide world......this problem caused me untold grief.....and i nearly involved trading standards over what i initially deemed as a "laptop unfit for purpose" which turned out to be your operating system.

    Many thanks for the pleasure !  

     

     

    Monday, January 04, 2010 12:37 PM
  • I am having the identical problem with a 64 bit HP PC.  It was working with Vista but switched to Windows 7. 
    Friday, February 26, 2010 1:15 AM
  • I have the same WMI event, and is followed by BSOD, I am almost sure mine started with a Windows Defender update.

    Tried running VBS script mentioned on above kb article (kb950375), but when I run it I get this error;

    Script C:\Users\...\...\test.vbs
    Line: 18
    Char: 17
    Error: Access denied
    Code: 80041003
    Source: SWbemObjectEx

    Kevin

    Sorry to bump up an old thread, but access was denied, because the script was trying to do something that will require administrative privileges and you simply invoked it by double clicking it. To rectify this, open command prompt with administrative privileges (click on start and type cmd into the search box, and when the command prompt icon appears, right click and run as administrator). Now from the command prompt, run the script.

    Best regards, Rajesh R Subramanian.
    Sunday, March 21, 2010 4:24 PM
  • The above post works after running the command prompt as admin.

    also I got rid of the problem of delay startup when all the applications hangs. I had activated family safety filter which was blocking most of the application for few minutes. I uninstalled it and now my system runs smoothly.


    Dhaval Heruwala
    Friday, April 30, 2010 3:58 AM
  • I am having the same problem, too, even after upgrading from VISTA to Windows 7 (mine is also a 64-bit HP). Will the above suggested fix kb950375 work for Windows 7, too?  Every time I go to that link, it detects that I have Windows 7, and tries to send me off to Windows 7 Solution Center, but I can find nothing about it there.  Has someone with Windows 7 tried the kb fix?

    Saturday, January 22, 2011 10:54 AM
  • Every boot or reset, I get the following message in the Admin Events of Event Viewer.  It would seem many others are having the same error, yet there is no obvious solution

    >>
    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
    >>

    The event Log Online Help reports many with the same problem, no solution other than to report it on this forum, so help appreciated

    Kotuku


    I have the very same problem after a fresh Install of Windows 7 SP1 RTM but I have not noticed it if I run the SP1 update on Windows 7.

    I have removed the memory and cleaned the contacts with an eraser, and there are no issues running memtest 86+ either.

    I am just curious why I am getting this after a fresh Install, without any other Installation.  It is present after every reboot.

    I have run the fix from here which does sort it out http://social.technet.microsoft.com/Forums/en/itprovistasp/thread/9273d705-709e-43bd-a06b-f02b5f649acb

     

    Friday, February 25, 2011 7:57 PM
  • I run windows 7 SP1 and I have done EVERYTHING for this same error. It makes my computer hang while playing any game and I BSOD because of it. I do not want to simply have the error not show up as proposed in a solution in this thread but I still have not fixed it. I downloaded CIM Studio as suggested above but I do not know what to do. I really hope someone can solve this once and for all.
    • Proposed as answer by Kobra Monday, May 30, 2011 5:28 AM
    • Unproposed as answer by Kobra Monday, May 30, 2011 5:28 AM
    Friday, April 29, 2011 1:48 AM
  • Hi guys,

    I think this same problem is causing random lockups on my system (Win 7 x64). Just started today. Usually the way this problem occurs is a song in wmp will stop playing, then the whole system locks up (or just sudden). I tried this from another forum:

    http://www.msfn.org/board/topic/114389-heres-how-to-fix-wmi-event-id-10-instancemodificationeven/

    Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


    Boot into safe mode. First, open services and stop the Windows Management Instrumentation Service. Take ownership of the folder or the contents of the folder "C:\Windows\System32\wbem\Repository." I've done this three times now on different installs and didn't have any issues after doing this, but I suggest you back up the folder to be certain. Delete the contents of the folder. Reboot. When you boot into Vista, you might notice a half dozen or so application errors...it's OK.
    Reboot again, and Event ID 10 will be gone, along with the afore mentioned application errors.

    Good luck, I'm not responsible for you hosing your system, & all that.

     

    I hope this solves it... btw c310 above your link just brings us back to this site.  As I finish typing this, my song cut out again!

    Monday, May 30, 2011 5:29 AM