WMI Provider Host taking up all of CPU

Hey Arthur! Before I get to the points you've mentioned, just want to share an update - mentioning all things that I think could be of relevance.

I played a small session today and had my Task manager open at all times - WMI Activity was there sporadically but mostly topping off at 15%. Is there any % considered normal btw for WMI? Or it should just not take any CPU at all in a "normal" scenario?

At 15% - there's literally no lags in the PC barring sometimes just say if I'm typing, the text would appear in a second or so randomly in between.

Linking the video of the Event Viewer logs: https://gyazo.com/162e7526fe6907375cc4ba8acd1fa786

Things to note:

• The session was played between 7PM-1:30AM, as you can see in the end, there were no "errors" in the log for that time specifically. Is it possible for WMI to take up CPU even if there are no errors? Maybe because a lot of programs are "approaching" WMI (hence the CPU usage) but not getting errors prevents it from taking a bizarre number? Just my guesstimates.
• Early on 2:30PM or so, it shows some errors which I checked, again same culprits: Express VPN, ASUS Com Service and NVIDIA Container. Any way to tackle these as these programs have been the recurring theme?
• Maybe not very relevant but Windows update rolled up some updates for today and I did it.

.

1 - I would definitely do as you suggested for MalwareBytes but before that I still want you to know it's only been say 10-12 days since I installed the MB program. The WMI issue has been since the start. In fact, MalwareBytes was an attempt to remove malware which could be causing a problem.

I understand you're thinking of it as a threat/cause of the problem (my guesstimate was on the same lines) because it showed up as an "obstruction" when we tried stopping WMI through CMD. That is the thesis behind our decision to cleanly remove MB, right?

Also, just struck me when I was scrambling through YT finding a solution and I remember there was one solution which included CMD and typing these commands, probably these are WMI related processes:

I remember probably 3-4 of these didn't go through something similar to System Error 5 came up. This too was after installing MalwareBytes though - 2 days after.

Also, until and unless there are new solutions on the table to try based on the new info I gave; I should first - remove MB cleanly through your steps and THEN try recreating the problem and if it still persists we move to -> clean boot and then stress test in the same environment and last resort being the downgrading to Windows 10. Right?

Thank you very much for your reply.

I will answer your questions from top to bottom first, of course in my mind you have become an engineer after this question!

1. I opened it with administrator privileges but it still reported “Access is denied” error. I re-tested and found that, in addition to this error, in fact, you also encountered “System error 5 has occurred”. There is also a request to “also stop services - Malwarebytes Service”.

I think there are two possibilities.

(1) Malwarebytes has bundled the WMI service invisibly to cause the problem, and the WMI service cannot be shut down without shutting down the Malwarebytes service.

This also corresponds to the use of Malwarebytes to detect malware as mentioned in your follow-up reply.

From a technical point of view I would suggest that you try to remove it, but to “cleanly remove” Malwarebytes you may need to borrow some other methods. Generally speaking, the usual uninstallation methods may not be able to uninstall it completely, because some antivirus programs can modify the registry and leave files or registry residues.

(2) In addition to this, there is also “System error 5 has occurred”, generally speaking, this error is reported that the user does not have the right to make changes, which is not because it is not run with administrator privileges. This is not because it was not run with administrator privileges, but because of the following possibilities:

 2.1 The blocking value has been tampered with by an application, e.g. Malwarebytes. 

 2.2 Some services are located in the system32 directory, and the current account is not the “Super Administrator account” (just a possibility). 

So I have a few suggestions to face this problem:

(1) Turn off the WMI service and Malwarebytes service at the same time. Unfortunately, since I personally do not have Malwarebytes on several test machines, I can't tell you the exact name of the service, so you can find it manually and turn it off.

Click “Windows Logo Key” to open the search bar -> type “Services” and open it with administrator privileges -> find all Malwarebytes related services in the list, change “Startup Type” to “Manual” and “Service Status” to “Stopped”.

(2) “Cleanly uninstall” Malwarebytes, please make sure to “cleanly uninstall” it!

(3) If you still can't execute the command to close WMI after closing Malwarebytes related services or clean uninstallation, please enable the Super Administrator account and log in.

Click “Windows Logo Key” to open the search bar -> Enter “cmd” in the search bar and open it with administrator privileges -> Please enter the following commands

net user administrator /active:yes

2. Thank you very much for the detailed information and video.

WMI is used by many applications for system monitoring, management and control, so it is indeed possible that the NVIDIA Container process you mentioned is the cause of the high WMI CPU activity.

Updating the BIOS works for the most part, but could potentially cause the problem to get worse.

However, in the current case, the fact that you removed the NVIDIA program but the problem still exists suggests that NVIDIA calls are not the only ones causing the problem, but there may be other applications or services that are constantly calling.

3. Clean Boot can be used both to identify third-party services or startup program conflicts and to locate them through dichotomization.

Generally you can do this:

(1) After running only half of the services to turn on the system, use the computer normally for a period of time to see if the WMI service is highly active

(2) If not, run the other half of the service.

Although clean boot uses only the smallest drivers and startup programs of Windows, it actually does not affect too much normal use. It is just possible that some applications are restricted or some external devices are restricted to avoid causing problems.

So you can open your poker session normally after clean start. Then just repeat the OK again.

For monitoring you can set up a new set of data collectors and log WMI and other metrics by using the Performance Monitor.

4. Downgrading to Windows 10 is indeed a practical approach from a testing point of view, and downgrading to Windows 11 will provide you with many fewer additional apps or features that may make playing poker easier and smoother.

Please note: In addition to backing up your data, downgrading from Windows 11 to Windows 10 may cause driver compatibility issues, which will require you to install the corresponding and compatible drivers.

I hope the information I've spent a lot of time testing will help you my friend without any problems :)

I look forward to hearing back from you. 

Best Regards

Arthur Sheng | Microsoft Community Support Specialist

I didn't quite get you.

Sure, Arthur. I could feel there's something off w the access denied situation as well, maybe it indicates why a lot of time other programs trying to reach out to WMI for system information and maybe it rejects it which causes errors and the CPU spike. That's what my non-tech brain could spit out as a guesstimate! :D

Eagerly waiting for your reply. :)