Process Information
Process File: wmiprvse.exe
Process Name: Microsoft Windows Management Instrumentation
Author: Microsoft Corp.
Part Of: Microsoft Windows Operating System
Description:
wmiprvse.exe is a part of the Microsoft Windows Operating System and deals with WMI operations through the WinMgmt.exe process.
Windows® Management Instrumentation (WMI) is a component of the Microsoft® Windows® operating system that provides management information and control in an enterprise environment. By using industry standards, managers can use WMI to query and set information on desktop systems, applications, networks, and other enterprise components. Developers can use WMI to create event monitoring applications that alert users when important incidents occur.
In earlier versions of Windows, providers were loaded in-process with the Windows Management service (WinMgmt.exe), running under the LocalSystem security account. Failure of a provider caused the entire WMI service to fail. The next request to WMI restarted the service.
Beginning with Windows XP, and then in Windows 2003, WMI resides in a shared service host with several other services.
It is a new Windows architecture intended to eliminate the previous problems in Windows 2000 where the failure of a WMI provider service would make the whole WMI service fail as, then, WMI provider services were loaded in-process with the WMI Service (a new request to WMI would restart the WMI Service).
To avoid stopping all the services when a provider fails, providers are loaded into a separate host process named Wmiprvse.exe. Multiple instances of Wmiprvse.exe can run at the same time under different accounts: LocalSystem, NetworkService, or LocalService. The WMI core WinMgmt.exe is loaded into the shared Local Service host named Svchost.exe.
Note: Attention to confuse the Wmiprvse.exe file with the wmiprvsw.exe file that is the Sasser worm!
Note: Note that, as with SVCHOST, there may be more than one instance of WMIPRVSE running in your Task List: this is normal. Also, some users will never have witnessed the WMIPRVSE service running on their Windows XP/2003 PC, and then notice it running one day and every day thereafter: this is also normal and will in most cases be the result of some software having been installed (and installing WMI provider services) or the result of a Windows Update. Finally, as with SVCHOST, if you experience errors or excess CPU usage with WMIPRVSE, the problem will in almost all cases be with the WMI provider process that WMIPRVSE is hosting, not with WMIPRVSE itself, or you may have a hardware problem or incompatibility which is not yet at the
serious stage – see if Microsoft's Windows Update has WMI related fixes for your PC/Server; also, on a network, we have empirical evidence that poor network card drivers or chipsets on any part of the network may result in excessive CPU usage by WMIPRVSE.
WMIPRVSE.exe program is important for the stable and secure running of your computer and should not be terminated.
For the layman: this is an essential Windows XP/2003 service which will start whenever a specific piece of software requires its facilities.
Note: Any malware can be named anything - so you should check where the files of the running processes are located on your disk. If a
non-Microsoft.exe file is located in the C:\Windows or C:\Windows\System32 folder, then there is a high risk for a virus, spyware, trojan or worm infection!
The wmiprvse.exe file is located in the C:\WINDOWS\System32\Wbem folder.
Recommendation for wmiprvse.exe:
Should not be disabled, required for essential applications to work properly.
Essential – leave alone.
Summary account
System Process: Yes
Application: No
Background Process: Yes
Uses Network: No
Uses Internet: No
Related processes
Winmgmt.exe
(www.parlandosparlando.com/view.php/id_546/lingua_1/whoisit_1)