Solved

WMIPRVSE.EXE processor high

Posted on 2007-03-28
5
2,816 Views
Last Modified: 2008-01-09
I have a user is trying to open outlook but a process called WMIPRVSE.EXE I killed the process but it comes back. I have run a virus scan and it did not grab anyhting significant. I plan to run the scan in safe mode and also run Hijackthis and see what it finds but thought someone there may have seen this before and know exactly what it was. I read where it can possibly be a virus and it sure acts like one, but with all the gurus there, maybe you all have seen this before. It will run the processor at around 80 to 90%.
0
Comment
Question by:millerdog
5 Comments
 
LVL 7

Accepted Solution

by:
pkutter earned 250 total points
ID: 18811749
Here's some info on this process - it's part of windows.
http://www.liutilities.com/products/wintaskspro/processlibrary/wmiprvse/

I ran into something similar earlier this week, but it was Omnipage that caused the problem instead of Outlook. I fixed it by removing and reinstalling Omnipage. You could try the same with outlook, or run a detect and repair from the help menu.
0
 
LVL 66

Assisted Solution

by:johnb6767
johnb6767 earned 250 total points
ID: 18812447
Something is tanking it, probably a corrupted application install. Could even be something malicious. First place I would look to identify it is Process Explorer.

Process Explorer for Windows v10.21
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

Double click WMIPRVSE.EXE, and select the Threads tab. Is there a single .dll or .exe causing the CPU Usage to run high? If so, double click on it and paste the output here.......

If you dont recognize the file, search the machine forit, and see if you can link it to an installed app. Might simply need a repair....
0
 

Author Comment

by:millerdog
ID: 18818071
I will do so today. I have not had any response from the user since I cleaned it. It may have been one of the virus's I cleaned off. I will get back to all after I go talk with her.
0
 
LVL 7

Expert Comment

by:pkutter
ID: 18821305
If you find a virus you should consider formating and reloading the PC. No telling how much damage was done or the possibility of root kits.
0
 

Expert Comment

by:donickco
ID: 27294838
im having the same problem i used Process Explorer an it coming back that kernel32.dll is hitting the cpu hard with 2-4 instances running

ntkrnlpa.exe!NtBuildNumber+0x2e
ntkrnlpa.exe!RtlCreateHeap+0x11ae
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcSendReceive+0x23
RPCRT4.dll!NdrSendReceive+0x28
RPCRT4.dll!NdrClientCall2+0x1a5
WINSPOOL.DRV!IsValidDevmodeW+0x172
WINSPOOL.DRV!GetPrinterDriverW+0xc6
WINSPOOL.DRV!Ordinal212+0x3f
WINSPOOL.DRV!DeviceCapabilitiesW+0x59
cimwin32.dll!DllUnregisterServer+0x5b89d
cimwin32.dll!DllUnregisterServer+0x5bf8a
cimwin32.dll!DllUnregisterServer+0x5c40d
cimwin32.dll!DllUnregisterServer+0x5c52d
framedyn.dll!Provider::CreateInstanceEnum+0x21
framedyn.dll!Provider::ExecuteQuery+0x72
framedyn.dll!CWbemProviderGlue::ExecQueryAsync+0x258
wmiprvse.exe+0x1a414
wmiprvse.exe+0x1a5bf
RPCRT4.dll!CheckVerificationTrailer+0x70
RPCRT4.dll!NdrStubCall2+0x215
RPCRT4.dll!CStdStubBuffer_Invoke+0x82
FastProx.dll!CUntypedArray::AppendRange+0xd50
ole32.dll!StgGetIFillLockBytesOnFile+0x10439
ole32.dll!StgGetIFillLockBytesOnFile+0x103e3
ole32.dll!CoReleaseMarshalData+0x7dc
ole32.dll!CoReleaseMarshalData+0x701
ole32.dll!StgGetIFillLockBytesOnFile+0x10319
ole32.dll!StgGetIFillLockBytesOnFile+0x101c4
ole32.dll!StgGetIFillLockBytesOnFile+0xff1d
RPCRT4.dll!NdrGetTypeFlags+0x1c9
RPCRT4.dll!NdrGetTypeFlags+0x12e
RPCRT4.dll!NdrGetTypeFlags+0x5a
RPCRT4.dll!CreateStubFromTypeInfo+0x2e7
RPCRT4.dll!CreateStubFromTypeInfo+0x328
RPCRT4.dll!NdrConformantArrayFree+0x28b
RPCRT4.dll!I_RpcBCacheFree+0x14c
RPCRT4.dll!I_RpcBCacheFree+0x5e3
RPCRT4.dll!I_RpcBCacheFree+0x405
RPCRT4.dll!I_RpcBCacheFree+0x5cb
kernel32.dll!GetModuleFileNameA+0x1ba



ntkrnlpa.exe!NtBuildNumber+0x93
ntkrnlpa.exe!MmIsDriverVerifying+0xbb8
hal.dll+0x2ef2
ntkrnlpa.exe!PsLookupThreadByThreadId+0x4cda
ntkrnlpa.exe!IoWMIQuerySingleInstanceMultiple+0x7b
ntkrnlpa.exe!IoWMISetSingleInstance+0xb5
mfehidk.sys+0x11128
mfehidk.sys+0x11de7
mfehidk.sys+0x11fcf
mfehidk.sys+0x16e3e
mfehidk.sys+0x1989b
ntkrnlpa.exe!ZwYieldExecution+0x17d1
ntkrnlpa.exe!LsaDeregisterLogonProcess+0x113d
ntkrnlpa.exe!KeSynchronizeExecution+0x2fc
ntdll.dll!KiFastSystemCallRet
unidrvui.dll!Ordinal270+0x831
unidrvui.dll!Ordinal270+0x781
unidrvui.dll!Ordinal270+0x737
unidrvui.dll!Ordinal270+0x18f
unidrvui.dll!Ordinal270+0x116
unidrvui.dll!DrvDeviceCapabilities+0x1425
unidrvui.dll!DrvDeviceCapabilities+0x1b
WINSPOOL.DRV!DeviceCapabilitiesW+0x86
cimwin32.dll!DllUnregisterServer+0x5baa8
cimwin32.dll!DllUnregisterServer+0x5bf8a
cimwin32.dll!DllUnregisterServer+0x5c40d
cimwin32.dll!DllUnregisterServer+0x5c52d
framedyn.dll!Provider::CreateInstanceEnum+0x21
framedyn.dll!Provider::ExecuteQuery+0x72
framedyn.dll!CWbemProviderGlue::ExecQueryAsync+0x258
wmiprvse.exe+0x1a414
wmiprvse.exe+0x1a5bf
RPCRT4.dll!CheckVerificationTrailer+0x70
RPCRT4.dll!NdrStubCall2+0x215
RPCRT4.dll!CStdStubBuffer_Invoke+0x82
FastProx.dll!CUntypedArray::AppendRange+0xd50
ole32.dll!StgGetIFillLockBytesOnFile+0x10439
ole32.dll!StgGetIFillLockBytesOnFile+0x103e3
ole32.dll!CoReleaseMarshalData+0x7dc
ole32.dll!CoReleaseMarshalData+0x701
ole32.dll!StgGetIFillLockBytesOnFile+0x10319
ole32.dll!StgGetIFillLockBytesOnFile+0x101c4
ole32.dll!StgGetIFillLockBytesOnFile+0xff1d
RPCRT4.dll!NdrGetTypeFlags+0x1c9
RPCRT4.dll!NdrGetTypeFlags+0x12e
RPCRT4.dll!NdrGetTypeFlags+0x5a
RPCRT4.dll!CreateStubFromTypeInfo+0x2e7
RPCRT4.dll!CreateStubFromTypeInfo+0x328
RPCRT4.dll!NdrConformantArrayFree+0x28b
RPCRT4.dll!I_RpcBCacheFree+0x14c
RPCRT4.dll!I_RpcBCacheFree+0x5e3
RPCRT4.dll!I_RpcBCacheFree+0x405
RPCRT4.dll!I_RpcBCacheFree+0x5cb
kernel32.dll!GetModuleFileNameA+0x1ba



ntkrnlpa.exe!NtBuildNumber+0x2e
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5e3
RPCRT4.dll!I_RpcBCacheFree+0x405
RPCRT4.dll!I_RpcBCacheFree+0x5cb
kernel32.dll!GetModuleFileNameA+0x1ba


0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Keyboard 4 96
Help with AMIDuOS program 3 63
Laptop won't display to other monitors 4 49
How Do I Set Up XP Mode in Windows 7? 8 63
Sometimes a user will call me frantically, explaining that something has gone wrong and they have tried everything (read - they have messed it up more and now need someone to clean up) and it still does no good, can I help them?!  Usually the standa…
When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now