WmiPrvSE.exe what the heck is it doing

[KT888]

This system has a 3770K CPU. The system is running at 25% CPU usage which is ridiculous but I don't know why it is using this much CPU resources. I have a 4770K system that is configured identically in terms of software including the fact that they are both running Windows 7 Ultimate it uses maybe 2 or 3 % at idle. The processor usage is related to 2 windows processes svchost.exe which is using around 13% (constantly) and the other is WmiPrvSE.exe which is using 10-12% CPU resources (nonstop) WmiPrvSE.exe is also doing A LOT or i/o reading on this system it starts reading on system boot up and doesn't stop. For some reason. I have no idea what it's doing but my other system doesn't do that and like I said they are essentially mirror images in terms of software setup. They also have access to exactly the same Hard Drive resources.
I have no idea what WmiprvSE.exe is reading I would like to know what the heck is WmiPrvSE.exe reading it's at about 100GB right now (i/o Read Bytes), my system's been running for an hour and it's been reading something the whole time since boot up? and also why are these 2 processes using so many cpu cycles for such an extended period of time. I've run Malwarebytes and it didn't find anything and I have Norton 360 running on the system which should be keeping me pretty safe in terms of any malware being the culpret of this weird issue. Does anyone know how I can actually find out what WmiPrvSE.exe is actually reading. It seems to me that there should be a tool that lets me see what all the activity is. I tried Process Explorer but couldn't find the actual files being read by the system. Thanks to all.

 

[AlexHTech]

here read this
http://www.makeuseof.com/answers/what-is-wmiprvse-exe-and-why-is-it-causing-high-cpu-usage/

 

[KT888]

Thanks Alex I've already seen it. It doesn't help me or apply to my situation. I already tried restarting WmiPrvSE.exe and it did nothing it did not "restart the services in order" the way RED said it would. All that happened is WmiPrvSE.exe just restarted and continued reading Something nonstop while utilizing about 12% cpu cycles. I even tried killing the process in task manager but again it just restarts itself and continues reading away. Something.

 

[KT888]

Some new information I've found out is that my 4770K machine also runs at 25% CPU usage at boot it does so until svchost is finished whatever it does at boot and WmiPrvSE also stops soon after boot. At this point the CPU utilization drops to 2-3%. However on my 3770K WmiPrvSE does not stop utilizing 10-12 % CPU utilization. What it appears to be doing is READING. I have no idea what it is reading and I don't know how to figure out what is being read. There are 18 Hard Drives available to both of these systems so I have no idea what is being accessed or even which drive is being read from (I would REALLY like to know this). Before I rebooted the 3770K last WmiPrvSE had read 130GB of data from somewhere in the hour and a half it was running. It never stopped reading. It was reading something from the time the system came online till it was rebooted. This is where the behavior of my 2 systems diverges. On the 4770K WmiPrvSE.exe does not engage in this constant reading behavior. It reads maybe 4GB and then stops this reading behavior. Does anyone know of an app that will let me find out what WmiPrvSE is reading. It seems like a virus like behavior because SOMETHING is reading all this information and I'm pretty sure it's not windows since the 4770K is not doing that and like I said the software configuration of the machines is very close to identical. I don't know how it could be a virus though since Norton 360 and malwarebytes find nothing so I have no idea how to explain the behavior of WmiPrvSE.exe. Anyone ever seen anything like this?

 

[Hellfire13]

there is certainly some app or software or process which is consuming wmiprvse.exe...
u need to check ur processes again...
go through this once...
http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/wmiprvse-using-high-cpu/ea1bb7b7-741e-499b-8bb4-6966ffa2b7dc?auth=1
https://forums.techguy.org/threads/solved-wmiprvse-exe-high-cpu-use.1108460/

 

[KT888]

I rebooted the machine between each of these steps. I tried removing all of the drives the 3770K has access to except the boot drive but WmiPrvSE is still reading information from somewhere so I can assume it is the SSD that windows is on and not the drives that I disconnected. I then disconnected the network including the internet and the reading activity no longer occured. I reconnected some of the local drives to the machine and still the reading activity did not occur. I reconnected the network and blocked WmiPrvSE from accessing the internet via my firewall but the reading activity still occurs when it is connected to the network so it appears that someone is not accessing my information via WmiPrvSE which is what it looked like when no activity occured when the machine was disconnected from the internet. I then tried disconnecting JUST my other machine but the reading activity still occurs. I tried the steps listed in the second link you provided closing each non microsoft service to see if the reading activity was caused by a 3rd party startup but the reading activity did not stop even after stopping all non MS startup processes. I also checked the size of the WmiPrvSE file against my other machine that doesn't have the problem and it is the exact file size so in addition to the norton 360 scan and the malwarebytes scan I verified it is not likely a virus.

So I'm stumped.

The reading activity is related to being connected to the internet but WmiPrvSE should not be able to send information across the internet since it's blocked from accessing anything outside my machine by a firewall rule. BTW once WmiPrvSE starts this reading activity it continues even if I then disconnect it from the internet. The activity is only prevented if there is no internet available when the machine boots up.

lol I have no idea what starts the reading activity but it is only started if there is internet available when the system boots up even though WmiPrvSE is blocked from accessing the internet.....

The only way I'm going to be able to figure this out is if someone knows an app that I can use to find out what is being read. I thought process explorer would be able to do this but I can't find it there.

 

[Hellfire13]

hmm...strange...
if WmiPrvSE is indeed reading from d internet thn u may never know wat kind of security breach potentials u might have...

this is one of the interesting stuff i found...mark d last sentence...
"WmiPrvSE is a safe process created by Microsoft and is needed for Windows to function properly. It shouldn’t be shut down or messed with, but doing so won’t cause a catastrophic failure of the system. Under normal conditions, it has a small system footprint and will only be running when you first launch Windows. If the process is causing problems, it is likely a virus with a copy-cat name."

go through this link and see if it helps...
http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/how-to-kill-wmiprvseexe-because-this-program-make/760b1919-c4b4-478b-b729-a4eec98136c1?auth=1

 

[KT888]

So you're never going to believe what the issue was. It was Speccy itself. The very tool I was using to try to get to the bottom of the issue I was dealing with which initially was the fact that my 3770K CPU was overheating which turned out to be a dead pump on the Corsair H80 water cooler and then I just started to notice the temps of my CPU which I never really paid any attention to. It turned out that the temps I thought were excessively high are the same temps my 4770K exhibits on bootup with the same CPU load. 60 degrees Celsius at 25% CPU load. Which seems high to me but I guess not.

Anyway I killed Speccy and restarted it a bunch of times just to make sure and it's definately Speccy. When I saw this morning that WmnPrvSE.exe had read over 550GB overnight I thought something is majorly wrong here and now I find out it was nothing. But what I don't understand is that Speccy does not do that on my 4770K machine at all. There's no special settings in Speccy that could cause this and I'm running Windows 7 Ultimate on both machines and as I mentioned they are essentially mirror images of each other software wise. So I have no idea what the difference is but it's definitely a load off my mind to know the cause of the weird behavior.

Thanks Hellfire for your help I appreciate you taking the time to help a total stranger it says a lot about you. Have a great day.

 

[Hellfire13]

i also have speccy but it never reads as voraciously as u r saying...if i were u, i wud uninstall completely and reinstall maybe...u may never know if thrs a rootkit tht has been attached to it or piggybacking it causing this unusual behaviour...

and u r welcome mate...cheers

 

[KT888]

If it was a rootkit it would be effecting both of my systems because they were both installed with the same download so I'm pretty sure that's not the case. I think I will try uninstalling it and reinstalling it though just to try something since it is such a weird issue. I don't download my software from anyplace sketchy so I'm certain it's not a virus anyway. Thanks for the suggestion.

 

[KT888]

So I just downloaded the latest version (v1.29 instead of v1.28.709) right from the Piriform site and after installation I'm running it and sure enough The bloody reading behavior is present. So it's using 10-12% of my CPU cycles adding an extra 10 degrees to my CPU and since the behavior is nonstop this heat and CPU drain is also nonstop. It's so weird I've never seen anything like it actually. I really wish I know what the heck it's doing. I think I'm going to send an email to Piriform and ask them what's up maybe they can provide some insight into their app's behavior.

 

[Hellfire13]

well...if this is d only system affected, m sure its not d software itself...something in ur system is triggering it...locating it would be a daunting task if not impossible...u can ask piriform for help...but i m not sure how much thy can help remotely...unless thrs some kind of bugfix...thr are alternatives to tht software...my suggestion wud be to use an alternative software till d time u reformat d system...most of d information can also be generated through inherent tools like msinfo32 or dxdiag...it is just a more graphical version...

 

[KT888]

Not really I am using it for temperatures actually neither of the windows tools you mentioned are useful for that. Any suggestions as to a good alternate for monitoring temperatures for all the system components?

 

[Hellfire13]

hwmonitor and hwinfo...both r gud...