wmiprvse.exe

[Digiface]

I noticed a little "problem" with this process, after upgrading my Sygate Firewall Pro from 5.5 to 5.6. It always used to stop little while after Windows was booted up, but now it doesn't. It stays running (or atleast stays running much much longer).

'Windows Management Instrumentation' service is set to "Automatic", like it was after firewall upgrade. When i restart that service, wmiprvse.exe process disappears, but it doens't fix the problem permanently.

Any idea why this wmiprvse.exe is acting this way now? And any possible solutions?

[Henrikx]

Importantly: The file “wmiprvse.exe” is in C:\WINDOWS\System32\Wbem. If not , it concerns with wmiprvse.exe a virus, a Spyware, a Trojaner or a Worm!

Example : W32/Sonebot-B Worm

[Digiface]

Yes, it's in system32/wbem folder. It used to stop automaticly little while after when Windows was booted up, but now it stays running.

[Henrikx]

The worm produces copies. If you are not sure, which process is original wmiprvse.exe, take a look to HijackThis.de Security.
http://www.hijackthis.de/en

[Digiface]

It's not an virus.

[Henrikx]

Sure ?!
W32/Sonebot-B drops a copy of itself to the Windows System32 folder with the filename WMIPRVSE.EXE and sets the following registry entries to run the copy on system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Kernel_check = wmiprvse.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Kernel_check = wmiprvse.exe

W32/Sonebot-B also attempts to terminate a number of processes and delete a number of files from the infected computer.

This worm may also set the following registry entries:

HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\
AutoShareServer = <value>
AutoShareWks = <value>

HKLM\System\CurrentControlSet\Control\lsa\
RestrictAnonymous = <value>
RestrictAnonymousSam = <value>

http://www.sophos.com/virusinfo/analyses/w32sonebotb.html

[Digiface]

Yes i'm sure.

[Henrikx]

Try this !

Start - Run - services.msc - double-click on "Windows Management Instrumentation" and set disabled or manually

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/about_wmi.asp

[bclee]

Thanks to Henrikx's post on services.msc , I was able to devise a workaround for a customer with the wmiprvse.exe problem on a WinXP SP2 system.

Later I found a problem when someone uses the printer fax driver for the fax function on their HP LaserJet 3055 AIO and the LaserJet isn't configured correctly or the driver itself is defective. Deleting the jobs from the queue for this fax printer drops the resources eaten up by wmiprvse.exe back to its normal insignificant amount. HP online support pages and MS Knowledgebase had nothing relevant about this for WinXP. My guess is that Windows was trying to continuously connect the broken fax process which causes wmiprvse.exe to eat up the CPU capacity.