WMIPRVSE.EXE spiking the CPU 99%

http://www.neuber.com/taskmanager/process/wmiprvse.exe.html

if your CPU is at 100% i would check for the viruses listed in that article.  Normally the WMI subsystem will take little if any visible CPU

Hi cheers ibu1, but there are no errors occurring and we do not run a Samba box. Also this is an XP Sp2 Desktop not a 2003 server.

Ta

No viruses/trojans or malicious traffic being generated and shavlik spyware Symantec antivirus not picking anything up ??
Also very similair to this http://support.microsoft.com/kb/925623 so phoned MS and got the patch but this did not resolve issue either. :-(

Hi check if you have multiple instances running.
Are you getting any events errors we can track?
What is wmiprvse.exe?
http://www.neuber.com/taskmanager/process/wmiprvse.exe.html

Make some program disable from startup.
Find that any abnormal program is there in startup which causes the above problem

This could be a printing problem - please remove all printers (and install the software from Add/Remove) from an affected computer - reboot - and put the printers back on.

Merete: On Machines that are running normally there are 2 instances sitting idle used by the SYSTEM account (which I have read you can have more than 3/4 instances at anytime depending on whats happening i.e. updates running, sms running, Mom running, etc)
Also on machines that are running at 99% CPU they also have 2 but only 1 is maxed out.

ibu1: Initially my reaction was to remove all the latest installed apps and disable all startup apps (except AV)  This did not help.

and235100: I removed all connected printers and uninstalled printing programs (i.e.Adobe Printer) that were listed in the printers location also removed all peripheral devices just incase. :-( No resolution here either. Also please remember this is happening on multiple networked machines so is unlikely to be caused by half uninstalled/installed peripheral device.

As a workaround for the time being - could you not just alter your policy settings under a single gpo, system services - and disable WMI?

I have been told in the past that WMI should not be disabled - but I haven't personally seen that it does any harm by disabling it.

and235100: Interesting solution I will have to check how this effects WSUS services and SMS Client but will check it out .... cheers buddy

It will not be possible to disable WMI ... Told by the boss!

Ha..Hmm

Okay - can you disable WMI on just 1 PC (to see if that makes any difference)?

I can confirm this would solve the issue as I have deleted the WMIPRSVE.EXE from a faulty machine and the process disapeared completely (obviously :-) ) So disabling WMI would have the same effect.
So the main issue being we require wmi to run on the machines but need to resolve why or what is causing it to max the CPU.
Interestingly enough someone just enlightened me to the fact that this is mainly Toshiba R200 laptops that are effected as well as 1 or 2 other models !!! Might investigate if this has been seen before on R200's

Okay - I would immediately (if not predictably) say - try and find and install updated drivers for your devices (as the next step).

"Traced it in process explorer and it seems to be genuine WBEM location so not a virus."

In PE, did you double click on wmiprvse.exe to see exactly which modules under it were tanking the CPU? Once you see that, please double click it again for the Call stac. Would you paste it here please?

It might not be the wmprsve.exe at all, but a module loaded into it's space....

Try:
http://www.microsoft.com/downloads/details.aspx?familyid=d7ba3cd6-18d1-4d05-b11e-4c64192ae97d&displaylang=en

Result - Actually, 2 things.
There seems to be custom Browser Helper objects installed on the machines.  This is where the SMS inventory Agent hangs.  Disabled the inventorying of the Browser Helper, re-install the SMS client and it has been fine for almost 2 hours on two different systems. Looks like a work around fix. So the issue is with SMS 2003 SP3 trying to inventory these objects!!! Our Guru across the pond is openeing a case with MS!!
Thanks for all your help guys.

If you have answered your own question, please ask a new, 0-point question in Community Support\General (http://www.experts-exchange.com/Community_Support/General/) containing a request to close the question, along with a reason (answered the Q myself) and a link to the original question.

As long as there is no objection from participating experts - the question will be closed after 4 days.

Thank you for the feedback richiesimpson others with a similar problem will look to your solution.
Thank you for using experts exchange.
Take Care
Merete

I"ve had the same issue.  The problem was HP Software.  I've installed HP 3050 AIO on several PC (XP SP2).  The problem was with HP's "Toolbox" application as part of the printer install.  I removed the Toolbox from the startup by running MSCONFIG.  Clicked on the "Startup" tab and deselected the HPTOOLBOX.  Problem resolved.

http://support.microsoft.com/?id=937882

In my case it looked like it was a printer problem.
I shutdown the printspooler in services. I deleted all files in c:\windows\system32\spool\printer
Finally shutdown the wmiprvse process.

It seems like there were some documents in the printer folder that were constantly trying to print.
It looks like everything is back to normal.

I have had the same issue as the initial query. Rolled out SMS Advanced Client across are organisation with the result that a handfull of XP PC's start running the WMIPRVSE.EXE at 99%. Strange that Microsoft have not clocked onto this one. Anyway, the fix I found to settle the machines down was to install Service Pack 3 for XP.