Wmiprvse.exe

• Darkboy132 wrote on 2013-07-02 06:45
  This thing's taking up a lot of my CPU, how do I get rid of it? Killing it doesn't work, and neither does restarting my computer.
• Ketchup wrote on 2013-07-02 07:08
  Its part of the Windows OS so I wouldn't want to mess with it could get screwy if you do something.
• Darkboy132 wrote on 2013-07-03 08:46
  But its taking up a whole ton of memory off my computer...
• Baku wrote on 2013-07-03 14:08
  First, make sure Wmiprvse.exe is located in C:\WINDOWS\System32\Wbem (Right click the process and click go to location) If it isn't there, then it's malware.
  
  If it is there, then there's some software that's asking a whole lot from the Windows Management Instrumentation.
  
  Try disabling gadgets, Network Meter specifically can be problematic with WMI.
  
  And also try restarting the WMI (Windows Management Instrumentation) service on the Service Panel.
  
  There's a lot more out there that can cause WMI to be a dick.
  
  Check this
  http://blogs.msdn.com/b/wmi/archive/2009/05/27/is-wmiprvse-a-real-villain.aspx
  
  It can help you figure out the PID (Process ID) of the process that is querying VMI and causing the CPU hog. (Enable the PID column on task manager to then kill that process, or figure out what program executes that process)
• Darkboy132 wrote on 2013-07-03 20:01

  Quote from Baku;1116285:

  Try disabling gadgets, Network Meter specifically can be problematic with WMI.
  
  And also try restarting the WMI (Windows Management Instrumentation) service on the Service Panel.
  
  (Enable the PID column on task manager to then kill that process, or figure out what program executes that process)

  
  
  How do I do that?
• Baku wrote on 2013-07-03 20:52
  Which of the three things you quoted? :p
  
  I'm not on a windoze box now so this is from memory:
  
  To manage gadgets you right click on the desktop and somewhere around there.
  
  To enter the Service Panel simply go to start menu and in the search box type "Services" and it should be there, look for Windows Management Instrumentation, right click on it, stop it and restart it.
  (You could also try typing gadgets on this search box if I was wrong on the last one, the manager should be there too)
  
  To enable columns in the task manager, look on the tool bar, the settings are somewhere around there.
• Darkboy132 wrote on 2013-07-03 21:02
  I restarted the service and its gone, thank you!
  
  But I can't find the option to disable gadgets.
  
  Also, the link you gave me came up with:
  

  - System
  
  - Provider
  
  [ Name] Microsoft-Windows-WMI-Activity
  [ Guid] {1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}
  
  EventID 12
  
  Version 0
  
  Level 4
  
  Task 0
  
  Opcode 0
  
  Keywords 0x8000000000000000
  
  - TimeCreated
  
  [ SystemTime] 2013-07-03T20:06:57.224032100Z
  
  EventRecordID 2551
  
  - Correlation
  
  [ ActivityID] {1C6DFE14-4986-4177-9988-616788E23A44}
  
  - Execution
  
  [ ProcessID] 428
  [ ThreadID] 3108
  [ ProcessorID] 1
  [ KernelTime] 169
  [ UserTime] 648
  
  Channel Microsoft-Windows-WMI-Activity/Trace
  
  Computer Andrew-HP
  
  - Security
  
  [ UserID] S-1-5-21-682961166-931729907-3314755842-1000
  
  
  - UserData
  
  - Operation_Provider_Info_New
  
  GroupOperationId 123
  
  Operation Provider::CreateInstanceEnum - CIMWin32 : Win32_Process
  
  HostId 3584
  
  ProviderName CIMWin32
  
  ProviderGuid {d63a5850-8f16-11cf-9f47-00aa00bf345c}
  
  Path %systemroot%\system32\wbem\cimwin32.dll

• Baku wrote on 2013-07-03 21:14

  [ ProcessID] 428

  
  Should be that one. That should be the PID of the process that is using WMI. Which should be able to be located in the Task Manager.
  
  

  [Image: http://blogs.msdn.com/blogfiles/ntdebugging/WindowsLiveWriter/UsingNetmontofigureoutthesourceofhig.exe_CAF1/image_6.png]

  
  [SIZE="1"]Image from here[/SIZE]
  (enable the PID column on "view" I think)
• Darkboy132 wrote on 2013-07-04 00:15
  There's like... 10 or so processes with PID 428... How do I narrow that down?
• Baku wrote on 2013-07-04 20:50
  Two processes can't have the same PID... just not possible, something weird is going on there, probably task manager crap doing multiple reports on the same one at different times of execution or something.
  
  But anyway, try to figure out where some of those processes originate, like see the location or search on google the process name. You can probably end all of them by right-clicking and terminating the process tree.
• Darkboy132 wrote on 2013-07-05 08:37
  I'm not sure how to look for PID in the Process tab, but my Task Manager has a Services Tab which says PID.