Scribd Logo
Upload

Welcome to Scribd!

  • 101 views

    What Is Wmiprvse - Exe

    Uploaded by

    MartaSekulic
    Wmiprvse.exe is a Windows process that runs WMI services and providers. It prevents termination of all WMI services if a provider crashes. It allows system services and network administration. It usually runs as NETWORK SERVICE, SYSTEM, or LOCAL SERVICE. Malware sometimes disguises itself as wmiprvse.exe. High CPU or memory usage by the legitimate wmiprvse.exe could be caused by a Windows update issue or other misbehaving service.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd

    What Is Wmiprvse - Exe

    Uploaded by

    MartaSekulic
    101 views3 pages
    Wmiprvse.exe is a Windows process that runs WMI services and providers. It prevents termination of all WMI services if a provider crashes. It allows system services and network administration. It usually runs as NETWORK SERVICE, SYSTEM, or LOCAL SERVICE. Malware sometimes disguises itself as wmiprvse.exe. High CPU or memory usage by the legitimate wmiprvse.exe could be caused by a Windows update issue or other misbehaving service.

    Original Description:

    service

    Original Title

    What is Wmiprvse.exe

    Copyright

    © © All Rights Reserved

    Available Formats

    DOC, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Wmiprvse.exe is a Windows process that runs WMI services and providers. It prevents termination of all WMI services if a provider crashes. It allows system services and network administration. It usually runs as NETWORK SERVICE, SYSTEM, or LOCAL SERVICE. Malware sometimes disguises itself as wmiprvse.exe. High CPU or memory usage by the legitimate wmiprvse.exe could be caused by a Windows update issue or other misbehaving service.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Download as doc, pdf, or txt
    101 views3 pages

    What Is Wmiprvse - Exe

    Uploaded by

    MartaSekulic
    Wmiprvse.exe is a Windows process that runs WMI services and providers. It prevents termination of all WMI services if a provider crashes. It allows system services and network administration. It usually runs as NETWORK SERVICE, SYSTEM, or LOCAL SERVICE. Malware sometimes disguises itself as wmiprvse.exe. High CPU or memory usage by the legitimate wmiprvse.exe could be caused by a Windows update issue or other misbehaving service.

    Copyright:

    © All Rights Reserved
    Download as DOC, PDF, TXT or read online from Scribd
    Download as doc, pdf, or txt
    of 3

    Download

    File information

    Database statistics
    910,35
    Total:
    0
    Whitelist 279,05
    :
    7
    Top process list
    svchost.exe
    iexplore.exe
    csrss.exe
    rundll32.exe
    lsass.exe
    alg.exe
    wuauclt.exe
    ccapp.exe
    explorer.exe
    ctfmon.exe
    spoolsv.exe
    services.exe
    smss.exe
    jusched.exe
    winlogon.exe
    mdm.exe
    rthdcpl.exe
    hkcmd.exe
    msascui.exe
    alcxmntr.exe

    What is Wmiprvse.exe
    WMI Provider Host - Microsoft Windows Operating
    System - Microsoft Corporation
    Run a Free Scan for WMIPRVSE.EXE related errors

    File description
    Wmiprvse.exe with description WMI Provider Host is a process
    file from company Microsoft Corporation belonging to product
    Microsoft Windows Operating System.
    The file is digitally signed from Microsoft Windows - Microsoft
    Time-Stamp Service
    We do not recommend removing digitally signed files from
    Microsoft Windows
    What is wmiprvse.exe?
    Wmiprvse is the Windows Management Instrumentation Provider
    Host program. When a Windows Management Instrumentation
    (WMI) service is loaded, the providers are loaded separately into
    wmiprvse.exe. It therefore serves as a host to prevent termination of
    all WMI services when the provider terminates.
    Essentially, it allows certain processes to run, including many
    system services. It is also used by applications that allow a manager
    to administer your system over an enterprise network. This process
    is not essential to the operation of the system; however, it is
    essential to the proper functioning of many system services. If it is
    not causing any problems, you should not terminate it. If you are a
    home user, and this process is causing problems, however, it is safe
    to terminate. The screenshot below illustrates how it should appear
    in the task manager:

    Although in this screenshot wmiprvse.exe is running as NETWORK


    SERVICE, it can also run as SYSTEM or LOCAL SERVICE. A
    process with this name running as a different user may be indicative
    of a malware infection.
    Dangers of wmiprvse
    As this is the name of a legitimate system process, it is common for
    virus writers and spyware vendors to disguise their malware as the
    genuine one.
    Some malicious files will have the same name but will be stored
    somewhere other than in %SystemRoot%\System32\Wbem. Other
    malware will use a name that appears similar to that of the
    legitimate one but with slight differences in spelling or with
    appended digits. The following malware is known to disguise itself
    as wmiprvse.exe:
    W32/Sonebot-B (%SystemRoot%\System32)
    o This is a backdoor trojan that includes an IRC bot
    that allows an attacker to issue remote commands.
    An indication of infection is a "Kernel_check =
    wmiprvse.exe" entry in the registry keys
    HKLM\Software\Microsoft\Windows\CurrentVersio
    n\Run and
    HKLM\Software\Microsoft\Windows\CurrentVersio
    n\RunServices.

    W32/SillyFDC-AW (%SystemRoot%)
    o

    This worm spreads via removable drives (e.g., USB


    flash drives and external hard drives) by creating an
    autorun.inf file to automatically infect a system upon
    connecting the device.

    W32/Sasser (wmiprvsw.exe)

    There will sometimes be several copies of this process running at a


    given time for any of the three aforementioned users. The presence
    of multiple instances is not a cause for concern; however, if it is
    running under a user that is not one of the above three, it is possible
    that it is malicious.
    Common problems
    This process uses 100% of the CPU
    o Ensure that your wmiprvse.exe is in %SystemRoot
    %\System32\Wbem, not %SystemRoot%\System32
    or %SystemRoot%.

    If it is the real wmiprvse.exe that is using 100% CPU


    time, the problem can be caused by a corrupt
    Windows Update log. Try disabling automatic
    updates and then perform a manual Windows
    Update. If it succeeds, reenable automatic updates

    Download and install the KB894391 hotfix from


    Microsoft's website.

    Try disabling unnecessary applications and services


    to see if the problem goes away. 100% CPU usage by
    wmiprvse.exe is usually caused by a separate service.

    If the above does not work, try uninstalling updates


    (starting with the most recent) until the problem goes
    away.

    This process uses an excessive amount of memory in


    Windows XP Service Pack 2
    o

    This is a known issue, for which there is a hotfix


    available from KB925623 on Microsoft's site.

    You might also like