Question WMIRegistrationService question

[Arbiter051]

Hello. When I updated my pc through windows update a couple of weeks ago, the service WMIRegistrationService seems to be running all the time now. I also see errors in event viewer that happen at every start up, 3 at a time listed as WMI Event 63 with the description:

"A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests "

I am sure this is nothing but, but I it is a little annoying and I was wondering if it was safe to just disable the service in services entirely. I have also done virus scans and nothing has been found and I have determined this happen after windows update on july 12th (I believe it was this tuesday) because before that non of these errors show up event viewer and non of this was going on.

Thank you very much.

 

[Colif]

Its part of Intel Management Engine Interface

Do you have an Intel motherboard? which one? might want to check if newer version of program. IMEI talks to CPU, its the chipset software - https://www.intel.com.au/content/www/au/en/support/articles/000008927/software/chipset-software.html

its not needed for windows but it might make PC work better. It shouldn't be running all the time.

What is the KB number of the 12 July patch? Look in update history and see if any drivers updated at same time, as they can come through windows update. Good chance Intel updates through it.

what did you scan for viruses using?

 

[Arbiter051]

Its part of Intel Management Engine Interface

Do you have an Intel motherboard? which one? might want to check if newer version of program. IMEI talks to CPU, its the chipset software - https://www.intel.com.au/content/www/au/en/support/articles/000008927/software/chipset-software.html

its not needed for windows but it might make PC work better. It shouldn't be running all the time.

What is the KB number of the 12 July patch? Look in update history and see if any drivers updated at same time, as they can come through windows update. Good chance Intel updates through it.

what did you scan for viruses using?

Hitmanpro pro is my go to.

intel does update through windows update which is another reason I figured it was windows update that did it.

I do have an intel motherboard, I can go to the manufactures website and see if they have a new driver version for it but the last time I checked it was from last year I think.

 

[Colif]

what model motherboard, i can go look for a newer driver as motherboard makers aren't always up to date with them.
Intel may have a newer one.

hitman pro would have been one suggestion. Bitdefender free another.

 

[Arbiter051]

what model motherboard, i can go look for a newer driver as motherboard makers aren't always up to date with them.
Intel may have a newer one.

hitman pro would have been one suggestion. Bitdefender free another.

z390 Aorus pro

I’ll check Intels website a little later when I get home. Hopefully the newer driver fixes this annoyance haha.

 

[Colif]

hmm, gigabytes newest is 2020 - https://www.gigabyte.com/Motherboard/Z390-AORUS-PRO-rev-10/support#support-dl-driver-chipset
Intel's newest is 2019 - https://www.intel.com.au/content/www/au/en/products/sku/133293/intel-z390-chipset/downloads.html

Makes me think you might want to run https://www.bitdefender.com.au/solutions/free.html and see if it finds anything.

 

[Arbiter051]

hmm, gigabytes newest is 2020 - https://www.gigabyte.com/Motherboard/Z390-AORUS-PRO-rev-10/support#support-dl-driver-chipset
Intel's newest is 2019 - https://www.intel.com.au/content/www/au/en/products/sku/133293/intel-z390-chipset/downloads.html

Makes me think you might want to run https://www.bitdefender.com.au/solutions/free.html and see if it finds anything.

There was an intel update from windows update on July 12. that is the day this all started. I think

The file is in system 32 and it’s signed by both Microsoft and intel. Virus total also says it’s nothing. At this point I think it’s just an intel update or Microsoft screwed something up.

I scanned with emsisoft tool kit and it also found nothing.

After doing more research almost everyone says it’s just a warning and is by design that can be safely ignored and it is related to the intel management engine. Not sure what it is warning me about exactly, I see conflicting answers.

 

[Colif]

oh yeah, You can mostly ignore events but I only looked as you said it was running more.

most of the events in event viewer happen once and are recorded, but the same action might work every other time. So its just a record of things happening, its not where I go to figure out problems in windows.

 

[Arbiter051]

oh yeah, You can mostly ignore events but I only looked as you said it was running more.

most of the events in event viewer happen once and are recorded, but the same action might work every other time. So its just a record of things happening, its not where I go to figure out problems in windows.

Oh yea don’t get me wrong I understood the concern. The registration service is constantly running now but it is def legit. I just don’t understand why it’s constantly running. It wasn’t before the windows update.
I can disable it in services but idk what that would do.

 

[Colif]

its hard to tell if the results I find are for a virus/trojan pretending to be that program or that the results of the post include that file name

I can't find a result similar for that application.

 

[Arbiter051]

its hard to tell if the results I find are for a virus/trojan pretending to be that program or that the results of the post include that file name

I can't find a result similar for that application.

Whenever I look up something like this 90% of the results are this is a Trojan/virus pretending so I never know either.

 

[Colif]

It also doesn't help that one result is from Brazil and others are from Germany , and the translation only does one post on page.

Normally I can find something

 

[Arbiter051]

It also doesn't help that one result is from Brazil and others are from Germany , and the translation only does one post on page.

Normally I can find something

I googled it a bit again and there are quite a number of threads of people on bleepingcomputer panacking for what turns out to be no reason XD

 

[Colif]

try running this and see if it helps
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

could be you first person to notice it too, I used to find problems before other people did. Might help to just check in a week or so.

 

[Arbiter051]

try running this and see if it helps
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

could be you first person to notice it too, I used to find problems before other people did. Might help to just check in a week or so.

Ah yea that was the first thing I tried but sfc said nothing was wrong.

may be right and I should just wait it out a bit. Maybe next windows update it will be fixed 🤞