none
WmiPrvSE.exe *32 is using 50% CPU on Windows 7 Professional 64 bit (Trace Attached)

    Question

  • Hi All,

    I have this WmiPrvSE high CPU usage problem for a while.  It will constantly eat up about 50% of CPU while I'm absolutely not using the computer.

    I have checked many articles on this forum and internet, but still cannot resolve this problem. I follow the instructions online to create the xperf trace, and I believe is the KernelBase.dll causing the problem.

    I'm not sure how to fix this problem with that DLL, because is Microsoft's. Anyone can help find out the real cause of this high CPU consumption problem?

    You can download the CPU.etl trace from here:

    http://cid-9b54026c4e12fbbd.office.live.com/self.aspx/Public/CPU.zip

     

    CPU Sampling by Process

    http://aa31qa.blu.livefilestore.com/y1p9nPtzQukNWIorTsws8IWToPnkYCTfd2oyVeJ18gtQwERyKN8zqfigQ6_tOik9dTwR2oJLhll4L47pAPz6DeoI0IPu3xy2ffJ/WmiPrvSE.jpg?psid=1

     

    Xperf Trace

    http://aa31qa.blu.livefilestore.com/y1pTWZ1aOt3bsgbjqeG3FYKtgstxLrO9dr8ClHO_5-8z9hDO50whEY11rNu_xy09Rfd_chNszJKBfXhDgmj4qSyjxp6IVUFg3pa/Xperf%20Trace.jpg?psid=1

     

     

    Wednesday, August 25, 2010 4:08 PM

Answers

  • Hi Leo,

    In the I saw that the AssetAdvisor.dll is involved.

    please check this:

    http://support.microsoft.com/kb/937882/en-us

    best regards
    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, August 25, 2010 9:22 PM

All replies

  • Hi Leo,

    In the I saw that the AssetAdvisor.dll is involved.

    please check this:

    http://support.microsoft.com/kb/937882/en-us

    best regards
    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, August 25, 2010 9:22 PM
  • Hi leoduan,

     

    This issue can be caused by third party service and software as well. Please recall if there is any software installed recently. If so, uninstall it and see if the issue occurs.

     

    Also, access Clean Boot to check the issue. If the issue disappears in the Clean Boot environment, you can continue to narrow down which entry is causing the issue.

     

    If the issue still exists, check this thread: Windows 7 wmiprvse overload

     

    Hope this helps.

     

    Regards,

    Linda

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    • Marked as answer by Linda Yan Thursday, September 02, 2010 1:57 AM
    • Unmarked as answer by leoduan Friday, September 10, 2010 7:19 PM
    Friday, August 27, 2010 7:09 AM
  • Hi,

    I got similar problem, but with Windows 7 starter edition, running on a Sony VAIO laptop, dual core cpu.
    Found out that the WmiPrvSe.exe (NETWORK SERVICE) is taking about an average 50% of both cpu core utilization.

    I ran the following command:
    tasklist /M /fi "imagename eq Wmiprvse.exe"
    and
    tasklist /SVC /fi "imagename eq Wmiprvse.exe"

    BUT, for both command, under the "Modules" and "Services" column, it just shows "N/A".
    So I am unable to determine which processes is using the wmiprvse.

    My laptop is not connected to any physical LAN, and I also tried turning-off/disabling both Wifi/Bluetooth, but that also does not bring the cpu utilization down.

    Have also verified that the wmiprvse.exe is correctly pointing to the c:\windows\system32\wbem\wmiprvse.exe, and even the file timestamp seems the same as the rest of the *.exe files within the .\wbem directory.

    Any other recommendation what better tools could be used to dig deeper to determine the process that is "using" the wmiprvse.exe?
    Or have an idea what actually could be the cause?
    Friday, August 27, 2010 7:44 AM
  • Hi,

    please also make a xperf trace [1] to diagnostic the high CPU usage. Please upload the etl file to your SkyDrive [2] and post a link here.

    I'll take a look at it.

    André

    [1] http://www.msfn.org/board/index.php?showtopic=140264
    [2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, August 27, 2010 12:32 PM
  • Hi,

    I got a similar problem. The process WmiPrvSE.exe *32 (NETWORK SERVICE) goes from 0% to 50% (approx.) CPU usage every few seconds, then goes back to 0% and keeps doint that forever. I managed to narrow it down being a conflict/problem with the WiFi/Bluetooth adapter, since when I turn the adapter off, the problem ends. Of course, if I turn it on again it starts.

    Other tests I ran were:
    - I updated all drivers and even BIOS. Windows Update is current too.
    - Ran the updated antivirus (Norton Security) and have resident Spybot S&D, no malware/virus found.
    - I closed all the applications and did a clean boot and it kept happening.
    - I created a new user and it kept happening under that user too.
    - Then I decided to turn the wireless adapter off (it's the wifi/bluetooth combo) and saw that the process WmiPrvSE.exe stopped behaving funny. So, maybe it's something regarding internet?
    - I decided to keep the wireless adapter off and connect via network adapter (using the commmon utp patch cable) and connected to internet. So it's not the internet nor a program using internet, it's something with the WiFi/Bluetooth adapter and the WmiPrvSE.exe service.

    Any idea on how to fix it? Thanks

    Friday, September 10, 2010 5:54 AM
  • Have you made the trace?

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, September 10, 2010 10:34 AM
  • Have you made the trace?

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/

    I posted this one in my question

    http://cid-9b54026c4e12fbbd.office.live.com/self.aspx/Public/CPU.zip

    Is this OK or need different type of trace?

    Friday, September 10, 2010 7:03 PM
  • Hi Leo,

    In the I saw that the AssetAdvisor.dll is involved.

    please check this:

    http://support.microsoft.com/kb/937882/en-us

    best regards
    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/


    Thanks, but I don't believe I have Microsoft Systems Management Server 2003 installed, and it seems only using about 7% of CPU.

    Regards,
    Leo

    • Edited by leoduan Friday, September 10, 2010 7:11 PM
    Friday, September 10, 2010 7:07 PM
  • Make a right click on the DLL and post what the manufacture is.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, September 10, 2010 7:11 PM
  • I meant Siramthar.

    I looked at your trace already. for me it's the AssetAdvisor.dll which causes it.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, September 10, 2010 7:12 PM
  • I meant Siramthar.

    I looked at your trace already. for me it's the AssetAdvisor.dll which causes it.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/

    I follow through the KB and download the patch from MS.

    When I run that patch, I received two errors

    1. "Not enough storage is available to process this command" then

    2. "installation did not complete

    I do have enough storage space, and memory, and I also tried run as admin but same errors.

    Friday, September 10, 2010 10:32 PM
  • Make a right click on the DLL and post what the manufacture is.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/


    Is this is right version?

    I will replace the one from the package and see if that will help.
    Friday, September 10, 2010 10:40 PM
  • Extract the exe with 7-zip [1] and run the msp installer. Does this work?

    [1] http://7-zip.org/


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Friday, September 10, 2010 10:49 PM
  • Extract the exe with 7-zip [1] and run the msp installer. Does this work?

    [1] http://7-zip.org/


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    I think that SMS patch fixed my problem! No high CPU usage by WmiPrvSE.exe the whole day today.

    Thanks a lot Andre!
    Monday, September 13, 2010 9:41 PM
  • Hi, yes, I made the trace.

    I was looking at the trace and found that it had to be the program HP Wireless Assistant. Checked on the forums about HP Wireless Assistant + wmiprvse.exe high cpu and this problem happened. Updated the HP Wireless Assistant to version 4.0.6.0 and now it's working fine.

    Thanks!

    Monday, September 13, 2010 9:55 PM
  • I think that SMS patch fixed my problem! No high CPU usage by WmiPrvSE.exe the whole day today.

    Thanks a lot Andre!

    Hi Leo,

    nice to hear that the patch fixes your issue :)

    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, September 14, 2010 10:02 AM
  • Hi Andre,

     

    I have generated the etl file but unable to upload, so have tried to perform my own identification...

    seems like the cause of the high cpu utilization seems to be caused by:

    framedyn.dll!WBEMTime::GetDMTF, which is calling framedyn.dll!WBEMTime::GetLocalOffsetForDate

    and further within the stack call is:

    KernelBase.dll!BasepLoadLibraryAsDataFileInternal, which is calling KernelBase.dll!CreateFieW

     

    Not sure how useful is the above fragment... is there any way which i could email/post the etl file?

    Thanks for the help!

    Sunday, October 24, 2010 3:19 PM
  • Hi Andre,

    Additional information for the above is the cimwin32.dll... after some googling discovered it's used for the WBEM and WMI (Windows Management Instrumentation)...

    The WMI service is used by the IP Helper and Security Center services which are both auto-started. (An additional Internet Connection Sharing service is not started)

    I manually stopped IP Helper and Security Center one at a time, but did not notice the CPU utilization problem still persist.

    But when i stopped the WMI service, finally the CPU utilization dropped down to near zero.

     

    Any idea if there's an available patch/fix for WMI?

    Thanks

    Sunday, October 24, 2010 4:31 PM
  • zip the trace file to minimize the size

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, October 24, 2010 5:35 PM
  • Hi Andre,

    I have manage to upload the zip file, here is the link: http://cid-3d6e272e1a854895.office.live.com/self.aspx/.Public/latency.zip

    Please advise.

    Thanks

    Tuesday, October 26, 2010 8:46 AM
  • Hi Cliff,

    the CPUusage occurs because of converting Timezone information into String which show the correct timezone data. Because several language uses different strings for Dat/time information this must be done. Which MUI packs do you have installed and what are the language settings on your Windows.

     

    Process Name, Process, Stack, Count, Cpu, Count: Sampled Profile
    , ,    |     OLE32.DLL!MTAInvoke, 844, , 844
    , ,    |     OLE32.DLL!CCtxComChnl::ContextInvoke, 844, , 844
    , ,    |     OLE32.DLL!StubInvoke, 844, , 844
    , ,    |     OLE32.DLL!SyncStubInvoke, 844, , 844
    , ,    |     fastprox.dll!CBaseStublet::Invoke, 844, , 844
    , ,    |     OLE32.DLL!CStdStubBuffer_Invoke, 844, , 844
    , ,    |     rpcrt4.dll!NdrStubCall2, 844, , 844
    , ,    |     |- rpcrt4.dll!Invoke, 843, , 843
    , ,    |     |     Wmiprvse.exe!CInterceptor_IWbemSyncProvider::CreateInstanceEnumAsync, 843, , 843
    , ,    |     |     Wmiprvse.exe!CInterceptor_IWbemSyncProvider::Helper_CreateInstanceEnumAsync, 843, , 843
    , ,    |     |     |- framedyn.dll!CWbemProviderGlue::CreateInstanceEnumAsync, 841, , 841
    , ,    |     |     |     |- framedyn.dll!Provider::CreateInstanceEnum, 839, , 839
    , ,    |     |     |     |     cimwin32.dll!Process::EnumerateInstances, 839, , 839
    , ,    |     |     |     |     |- cimwin32.dll!Process::Enumerate , 824, , 824
    , ,    |     |     |     |     |     |- cimwin32.dll!Process::LoadCheapPropertiesNT, 811, , 811
    , ,    |     |     |     |     |     |     |- framedyn.dll!CInstance::SetDateTime , 746, , 746
    , ,    |     |     |     |     |     |     |     |- framedyn.dll!WBEMTime::GetDMTF, 743, , 743
    , ,    |     |     |     |     |     |     |     |     |- framedyn.dll!WBEMTime::GetLocalOffsetForDate , 738, , 738
    , ,    |     |     |     |     |     |     |     |     |     KernelBase.dll!GetTimeZoneInformation , 738, , 738
    , ,    |     |     |     |     |     |     |     |     |     KernelBase.dll!GetTimeZoneInformationRaw, 738, , 738
    , ,    |     |     |     |     |     |     |     |     |     |- KernelBase.dll!ConvertTimeZoneMuiStrings , 737, , 737
    , ,    |     |     |     |     |     |     |     |     |     |     KernelBase.dll!ConvertTimeZoneMuiString , 737, , 737
    , ,    |     |     |     |     |     |     |     |     |     |     |- KernelBase.dll!LoadLibraryExW, 483, , 483
    , ,    |     |     |     |     |     |     |     |     |     |     |- KernelBase.dll!LoadStringBaseExW, 211, , 211

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, October 26, 2010 11:24 AM
  • Hi Andre,

     

    The laptop came everything pre-installed from Sony VAIO, and have not installed any additional MUI pack.

    Please advise what else could be done?

     

    Thanks

    Cliff

    Wednesday, October 27, 2010 8:28 AM
  • What are your language settings?

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, October 27, 2010 9:14 AM
  • Hi Andre,

    The laptop language setting is only in English(US), no other special setting.

    What are the other possible cause?

    Thanks

    Cliff

    Saturday, December 04, 2010 7:51 AM
  • What are the other possible cause?

    I have no real idea. You can run Process Monitor, maybe you can see more.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Saturday, December 04, 2010 1:39 PM
  • Hi, I've had the same problem, but found out it was caused by Windows live family safety. When stopping these services (simply type "services" at run, and stop service windows live) the problem stopped, I found the sollution at http://social.technet.microsoft.com/Forums/en/w7itprovirt/thread/90387e52-dcb9-4137-b78f-25c2026a680b. Not sure yet what causes the problem, maybe a bug in windows?
    Sunday, October 30, 2011 1:28 PM
  • Any application can make WMI queries.  WMI debug logging:  http://blogs.technet.com/b/askperf/archive/2008/03/04/wmi-debug-logging.aspx

     

     

    Monday, October 31, 2011 6:54 PM
  • You are my savior!!!

    I updated HP Wireless assistant to version 4.0.6.0 and now Wmiprvse.exe doesn't overload cpu anymore.

    Thank you very much.

    Sunday, January 22, 2012 10:18 AM
  • Hi Everyone,

    I seem to have the same problem, but I can't figure it out, even after following Andre's steps and capturing a trace. I thought I followed all the steps for getting a stack trace (setting the symbol path and the DisablePagingExecutive key), but it's not very good:

    The full trace is here: https://skydrive.live.com/redir.aspx?cid=b3a97dd703753c82&resid=B3A97DD703753C82!3764&parid=B3A97DD703753C82!113 

    Also tried googling gpedit, fastprox and wpc, but didn't find anything obvious. Does anyone have any clues?

    Sunday, January 22, 2012 9:25 PM
  • Another way is to follow that link I posted about debugging wmi, then check the wmi log file at the time of the problem.

     

    Monday, January 23, 2012 8:24 PM