CPU running at 100% - wmiprvse.exe eating up CPU

[danmul]

Hi,

I have a home PC that the CPU is running at 100% as soon as I login. The process that is causing the problem is a wmiprvse.exe process. I know that this is a windows management process and can also be a virus. I have checked the registry for entries (if it is a virus there are supposed to be entries). There were none. I am running Mcafee anti-virus. Any ideas why this is happening?

Thanks,
Daniel.

 

[linney]

Some of the WMI changes that are included in Windows XP SP2 are designed to help reduce issues that might occur between different hosting models when these hosting models load providers. Different hosts might include Microsoft Internet Information Services (IIS), a Windows service, or an enterprise service. To start a provider, each host starts a new process that is named WMIPRVSE. The WMIPRVSE process loads the actual provider. When you use different hosting models, the WMIPRVSE process is started by using different Windows credentials."


Some more on WMIPRVSE in this article.

Event ID 63 occurs when you run the Microsoft System Information program from Office 2003PSS ID Number: 891642


It will help your troubleshooting if you check in Safe Mode for the problem, and then in Normal Mode as a different username.


310353 - How to Perform a Clean Boot in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&FR=1&PA=1&SD=HSCH

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310560&FR=1&PA=1&SD=HSCH

Removing adware & spyware
faq608-4650

Try the free version of "Ewido"

http://www.ewido.net/

Windows Defender

http://www.microsoft.com/athome/security/spyware/software/default.mspx

 

[danmul]

Hi,
Thanks for reply. I will try these as soon as I get home. I have tried it as different users and the result is the same. The process that does start is a Newtwork Service. Don't know if this gives you any clues as to the origin of the starting program?
Thanks again,
Daniel.

 

[linney]

Not really, I see that lead-in blurb from that article mentions IIS, and I remember that ZoneAlarm and IIS have caused problems when run together. So it may pay you to look at your firewall to see if it is configured correctly, or has some warning in any firewall logging, and also check the Event Viewer.

What happens if you remove the machine from any Network by disconnecting any cabling etc?

Not sure what "NetworkService" would be referring to, there is a logon for several Services in Computer Management that use the "NT AUTHORITY\NetworkService" logon, you could look at some of those Services to see if they are having a problem.

 

[danmul]

Will check firewall. What puts me off is that there is no network traffic. I am not even using any software. It just starts after I login. The firewall being used is Mcafee. I will try to stop Mcafee starting on startup and see if that works. If that is the case then I have another problem - no virus protection.

 

[danmul]

Hi,

I took the easy way out of this. I went into msconfig and disabled the service Windows Management Instrumentation. can anyone let me know if this will affect anything else on the PC. It all looked to be running fine last night.

Thanks,
Daniel.

 

[linney]

The Security Center Service, and the Windows Firewall/ Internet Connection Sharing (ICS) are dependencies of that particular Service.

Windows Management Instrumentation provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

It would be wise to check your Event Viewer to see the outcome of your changes.

The disabling of Services should be performed through the actual Services Snap-in so that you can right-click on service-name to ascertain the extra valuable information contained therein.