# High Disk Activity with wmiprvse.exe



## hsgrewal (Sep 16, 2014)

Hi,

My Laptop has win7 operating system and is witnessing excess disk activity which makes my laptop freeze. After testing for malware through various tests and also running combofix etc. Ran process monitor and found WMI processes were the culprit with around 80% of disk activity concentrated around windows/system32/wbem/repository/objects.data and index.btr. Thereafter enabled analytical and debug logs in event viewer. Almost all activity is related to

Log Name: Microsoft-Windows-WMI-Activity/Trace
Source: Microsoft-Windows-WMI-Activity
Date: 16/09/2014 7:50:54 PM
Event ID: 1
Task Category: None
Level: Information
Keywords: 
User: SYSTEM
Computer: dell-PC
Description:
GroupOperationId = 1246; OperationId = 1248; Operation = Start IWbemServices::ExecQuery - Select * from __ClassProviderRegistration; ClientMachine = Local; User = .\SYSTEM; ClientProcessId = 0; NamespaceName = \\.\Root\Microsoft\HomeNet
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI-Activity" Guid="{1418ef04-b0b4-4623-bf7e-d74ab47bbdaa}" />
<EventID>1</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2014-09-16T14:20:54.308281200Z" />
<EventRecordID>2</EventRecordID>
<Correlation />
<Execution ProcessID="904" ThreadID="1904" ProcessorID="0" KernelTime="0" UserTime="0" />
<Channel>Microsoft-Windows-WMI-Activity/Trace</Channel>
<Computer>dell-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<Operation_ xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
<GroupOperationId>1246</GroupOperationId>
<OperationId>1248</OperationId>
<Operation>Start IWbemServices::ExecQuery - Select * from __ClassProviderRegistration</Operation>
<ClientMachine>Local</ClientMachine>
<User>.\SYSTEM</User>
<ClientProcessId>0</ClientProcessId>
<NamespaceName>\\.\Root\Microsoft\HomeNet</NamespaceName>
</Operation_>
</UserData>
</Event>

Kindly provide help since this is a big nuisance. Your adice 

Thanks

Harpreet


----------



## DBCooper (Jun 11, 2010)

Hi there,

I googled the "wmiprvse.exe" and I came across this link. This seems pretty informative, check it out: About Wmiprvse.exe: Why It Consumes High CPU and How to Fix Wmiprvse.exe Error

Please provide an update when you can, thank you.


----------



## hsgrewal (Sep 16, 2014)

Hi,

Thanks for the reply. I had already tried disabling WMI services before but it did not have an impact. Also, my CPU usage is only 2-3%, however, my disk activity every other second reaches 100% which freezes my laptop till the reading of the repositories folders gets processed. I dont think its malware because i have run 5-6 anti malware tests as well as anti virus tests. 

When i tried suggestion A, this error came
C:\Users\dell>reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiprvse.exe" /v debugger /t reg_sz /d debugfile.exe /f
ERROR: Invalid key name.
Type "REG ADD /?" for usage.


It appears to be a genuine service call from root/microsoft/homenet which i could not find through googling also. And this happens continuously. I disabled firewalls and security centre also but it did not have an impact.

If you could throw some light it could be of great help.

Regards,

Harpreet


----------



## hsgrewal (Sep 16, 2014)

the issue appears to be similar to
http://www.techsupportforum.com/forums/f217/wmiprvse-exe-spiking-up-cpu-695434.html

a solution appears elusive other than a windows clean install


----------



## BIGBEARJEDI (Aug 8, 2012)

This could also be a hard drive related failure.  As your computer is about 5 years old or so with the Win7, the hard drive could be faulty. Bear in mind that hard drive failure in computers starts as early as 2 yrs. in laptops and 3 yrs. in desktops. Hard drives are the #1 failed component in *ALL* computers. :frown:

I suggest you test your hardware with some simple free tools. _This could save you a lot of time and frustration._ As you mention in your Post #4 a windows clean install will *ONLY* solve the problem if it is indeed due to a software problem. *A reinstall, which is a software reconfiguration will NOT fix a hardware fault on any computer.* :facepalm:

Links to the tools are in my signature below:
*1)* Download the free *Seatools* drive diagnostic and run *BOTH* the short and the long tests. If Seatools returns any errors, your hard drive has failed and needs to be replaced! 
*2)* Download free *Memtest* and test your RAM memory sticks 1 at a time until all are tested, each pass for each stick *a minimum of 8 passes*. If any RAM stick returns errors, it is faulty, and also needs to be replaced. 

These are the minimum tests you should perform, as Hard drives and RAM sticks are 2 of the most commonly failed compnonents in computers 3 yrs. old and older (except Laptops which I already mentioned). :nonono:

_**Finally, if no faults are found with your RAM or your Hard Drive per the tests above, it would make sense to then do a Clean reinstall of Windows. If you have *FACTORY RECOVERY DISCS*, or you can make them from existing software on your computer, this will facilitate the reinstall getting done days sooner than if you try to reinstall from a generic copy of MS Windows in the retail box since you will have to spend 1-3 days downloading drivers from the Manufacturer's website and installing them all one at a time! :uhoh:**_

Give that a try and post back so we can advise further. 

Good Luck, :thumb:
BIGBEARJEDI


----------



## hsgrewal (Sep 16, 2014)

when i run seatools... at initialisation stage itself it gives error 

fatal error : device discovery
argument 'length; must be greater or equal to zero, system. string mid (system. string, int32, int32)

am unable to run any test.. since on ok seatools closes

does this mean there is hard disk error?


----------



## hsgrewal (Sep 16, 2014)

ran western digital data lifeguard daignostics - both short and extended tests - they were a success. I guess it does the same things as seatools


----------



## BIGBEARJEDI (Aug 8, 2012)

Good job there! since your drive passed 1 diag. it's probably ok. time to do a clean reinstall of window7 per final paragraph in my previous post.
Post back your result after.
BBJ


----------



## hsgrewal (Sep 16, 2014)

The problem after format of drive and windows reinstall still persists.

The disk activity I.e. Green line stays very low at a few kbs but the blue line stays at 100 percent activity for half of the time.

Only windows has been installed till now.

Tried running seatools again but it gave the same error.

Is it possible that western digital diagnostics tool gave a success for the tests but the hard disk may still have problems.

Thanks for your time.


----------



## hsgrewal (Sep 16, 2014)

basically the question is what is causing very low disk I/O but very high disk activity on a freshly formatted drive with only windows installation. 

chdsk and western digital diagnostics test were also successful.

regards,

harpreet


----------

