WmiPrvSE.exe

Hey. There's this process called WmiPrvSE.exe that's using up a lot of CPU power, usually in the 25% range but anywhere from 5~70%. Google has been singularly unhelpful with this.

Does anyone know how to disable it? Reinstalling is far too much of a hassle for me. My laptop is an Asus G50V-A1 purchased a few months ago. Not sure when problem started but I'm quite sure it wasn't there at first installation.

Norton 2008 Internet Security comes up with nothing.

Thanks

 

Thats a windows management instrumentation process I guess. And if I understand correctly you should not disable it.

But it can also be that its a virus. Have you tried running an antispyware scan? (something like SAS or MBAM? Or may even try with Threatfire.).

 

I dunno how to disable it if I could.

Well, Norton's not saying anything... Not sure if I can install another anti-malware utility.

 

do not run more than one antivirus at once, it would mean another slowdown (and possible conflict, system instability etc etc)

regarding the one particular file, you can try scanning it at virustotal.com, you'll get results from 30+ AVs at a glance

in case that you want to scan whole computer and try some other antivirus software, uninstall the previous one first before installing something else (for reasons mentioned above), you can install it back later

 

Where is the file located?
Windows Management Instrumentation should only be in C:\WINDOWS\System32\Wbem as described here.
If it resides somewhere else you're infected.
You can use Security Task Manager to find out where wmiprvse.exe is located.
Cheers.

 

It's not in the folder mentioned above. The offending process in C:\Windows\SysWOW64\wbem. There's another process with the same name in C:\WINDOWS\System32\Wbem but that one is benign.

I used the online uploading/scanning tool from virustotal and it comes up with nothing.

 

the reason why you found 2 instance and 2 different locations for this process is that you're using a x64 bit OS (maybe Vista ) , so C:\Windows\SysWOW64\wbem will contain 32bit version of the process and C:\WINDOWS\System32\Wbem should be having its 64bit counterpart

AFAIK both the process are genuine windows process

 

I once found a virus has placed a file into C:\Windows\SysWOW64 before. But I think this process in particular helps Windows Update and Windows do their thing.

 

Is there anyway of fixing those processes? I can't have them eating up 50% of my processing power especially if I'm on battery.

 

Try disabling some services. www.blackviper.com is a good place to search and find out which processes you can safely disable.

WmiPrvSE.exe doesn't show up in my task manager. I'm pretty sure one of the services that I disabled stopped the process from running.