sobota, 13 grudzień 2008

WmiPrvSE.exe - a seasonal CPU hog

Background


Is your Vista acting crazy sometimes? It's normal. But when it starts to put your notebook in danger of overheating by spawning a WmiPrvSE.exe process that eats 100% of the CPU, it's not normal. It happened to me. I've searched the Web, applied every single solution, scanned my computer with numerous anti-(virus, spyware, malware, rootkit) applications, and still nothing. Once in a while (usually everyday) my notebook (HP Pavilion dv9790) was alarming me with his fans that something wrong was going on in the system. Short investigation showed that one of the components (to this day I don't know which one, and I really almost reinstalled EVERYTHING) is using WMI in a way that causes WmiPrvSE.exe process to start eat all available CPU power and enormous amounts of system memory - and the process does not end. Usually killing the process was enough... until it reoccured next day or later. Fearing that it may actually kill my notebook, I decided to fight back and wrote a simple apllication that periodically monitors the system, and when it detects that WmiPrvSE.exe is working too hard and for too long, it just kills it.


How it works


The application installs as a system service and is set up to start automatically on system start. Initially, service is in the idle state. In this state, it scans the process list and CPU usage every 60 seconds. When it detects that WmiPrvSE.exe process is on the list and is consuming more than 80% of the CPU core, it enters the alert state. In this state, it monitors the task list every 10 seconds. When it detects that the CPU usage exceedes 80% of the CPU core for five consecutive pollings, it immediately sends the KILL signal to the respective process. Basically this means that WmiPrvSE.exe is allowed to hog the CPU for 1 to 2 minutes. Then it dies. Each such execution is logged in the Vista event log, allowing you to scan it and find out when it happened.


When to use it


When? When you're encountering the same problem and you're lost all your faith that you will find a real cause of the problem. Otherwise, you're free to look for the real solution it and post it here - it is more than welcome. Reinstalling Vista doesn't count as a solution.


How to use it


Download the setup from the location indicated below and run it with administrative priviledges to allow it to install a system service. The service will be started right after the installation finishes, and then on every system boot.


Where to find it


Version 1.1:
- Softpedia
- Mirror 1
- Mirror 2


Change Log


Version 1.1:
- added README and DISCLAIMER
Version 1.0:
- initial version


DISCLAIMER


THE PROGRAMMER EXPRESSLY DISCLAIMS ANY WARRANTY FOR THE SOFTWARE. THIS SOFTWARE AND THE ACCOMPANYING FILES ARE GIVEN FOR FREE "AS IS" AND WITHOUT WARRANTIES AS TO PERFORMANCE OF MERCHANTABILITY OR ANY OTHER WARRANTIES WHETHER EXPRESSED OR IMPLIED

THE PROGRAMMER MAKES NO FURTHER REPRESENTATIONS OR WARRANTIES EXPRESSLY OR IMPLIED SUCH AS BY WAY OF EXAMPLE BUT NOT OF LIMITATION REGARDING MERCHANT ABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE, OR THAT LICENSED SOFTWARE IS ERROR FREE, OR THAT THE USE OF THE SOFTWARE OR ANY COPIES THEREOF WILL NOT INFRINGE ANY PATENT, COPYRIGHT OR TRADEMARK OF THIRD PARTIES.

IN NO EVENT SHALL THE PROGRAMMER BE LIABLE TO YOU FOR ANY CONSEQUENTIAL, INCIDENTAL OR INDIRECT DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, OR ANY OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF OR INABILITY TO USE THIS SOFTWARE EVEN IF THE PROGRAMMER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

THIS SOFTWARE IS NOT FAULT TOLERANT AND SHOULD NOT BE USED IN ANY ENVIRONMENT WHICH REQUIRES THIS.

THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU.