WMI Provider Host taking up all of CPU

Hey Arthur! Hope you're doing well :)

I ended up shifting to Windows 10 and restored all data and apps as needed. I didn't face any problems and it was smooth for 2 weeks now - until today when during playing a session again my WMI spiked up even though it went to 20% at max till now and saw it at 5-7% till now. https://gyazo.com/aa4d79a9b956adc20d3fe735a00fdf66

I tried figuring out the program which caused eorr in the logs - only found one (couple of errors) which was a program I used to play poker called WPT. A poker app basically. I found some PID's which weren't to be found in the ongoing processes in the task manager.

I tried doing this which was the last step of what you told me: https://gyazo.com/26a7e8116e1a188119300dbbb93f7aa0 Hopefully this settles it? Do I have to do it everytime I start my PC? Like if the service was stopped, will it restart on it's own upon the "frequent calls" if there are any?

Please let me know how to figure this out and solve this for good!

Hey Arthur! Again thanks for the extensive research and testing you have carried out for me. If there's any portal or avenue where I can pay you for your service thus far and for future replies, I would like to do so, or anything else really as a token of gratitude. :)

Couple of things I saw, one I don't know if it's related to this or not but my Boot time (IDK if that's exactly what it's called - the time from when I turn the CPU on and the screen shows up with Republic of Gamers and boots up) was one random time up to 4-5 mins. Like I switched on the CPU and thrice force shut it through long pressing the power button and 4th time it actually started after a 2-4 minute delay. I don't know if it's relevant. I don't know but don't think it's a hardware problem, there are no heating issues as well.

1 - Thank you for the explanation. I tried doing this:

It again said access denied to even stop the MB service.

Video: https://gyazo.com/1a0d50cf8668ded5fac46300f0aebd54

I enabled the super administrator command:

And tried after this, unfortunately the same error occurred.

That's what i was supposed to do to clean uninstall MB right? I couldn't find any more steps I could try.

2 - Glad to know clean boot won't interfere with the normal working. So does that also mean if the WMI problem doesn't occur I can just use the PC in clean boot mode itself? Also, I'm assuming our objective of doing a clean boot is to find what "programs/services" are creating this issue - haven't we already achieved that via the PID indexing and match them up to the processes?

3 - Even though as a poker player, I love problems and have a curious mind so I really don't wanna give up on this half way but more and more I dive deep into it, my threshold of understanding is getting hit and I may not efficiently follow instructions etc. I'm beginning to think rebooting and downgrading to Win 10 is the most convenient way to go about it. :|

Hi Gaurav,

Please try the clean boot procedure Arthur.SH - MSFT recommended earlier. A clean boot is the process of starting Windows without loading third-party apps and services. It's a safe procedure.

For more information, see this Microsoft article.

How to perform a clean boot in Windows - Microsoft Support:

https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd

(Step 3 is very important. You need to first enable "Hide all Microsoft Services" before clicking "Disable all".)

Thank you for the additional information my friend.

1. The first thing is that the WMI is always around 15%. Actually the occupancy is still divided into points, because if there are multiple applications querying and calling WMI, there will be different occupancy. Personally though, it's still low, and probably around 6% at most when calling and querying as well.
2. In the event viewer you provided, I found the error event as:

WMI-Activity Event ID:5858 ResultCode:0x80041032

Since this involves a lot of highly technical jargon, I have personally summarized it to make it as understandable as possible for you.

Combining all our previous information, we can conclude that the cause of the problem is due to an application (WMI caller) calling and then retrieving the full result set and releasing it. But the client releases the termination link and then logs it once in the event viewer.

Such frequent logging indicates that there are unusual calls and their frequency is very high leading to similar problems. This also corresponds to what I illustrated in (1), that the more or more often an application calls and queries WMI, the higher the footprint.

I think we can start with this:

   (1) Go to Event Viewer and log “ClientProcessid = \*\*\*\*\*” in Error. 

   (2) “Ctrl + Shift + Esc” to open Task Manager, enter this PID and search for it to find out which service or application is running (should include Express VPN, ASUS Com Service and NVIDIA Container as you mentioned). 

  (3) Try right-clicking to disable it and wait a while to see if it still calls. (But considering that there is a VPN that you may need for your poker game, it is recommended that you just try it for now to find out why.) 

Actually, there is a solution to this problem, but I think it's a bit too technical and may not be particularly convenient.

The link is: WMI-Activity Event 5858 ResultCode 0x80041032 - Windows Client | Microsoft Learn.

3. Next, the CMD command. These commands are related to stopping and starting the WMI service, but several of them have the problem of “system error 5” when running. This should still be related to MalwareBytes, and after making sure we have administrator privileges, it can only be some third-party application blocking or service bundling that causes similar problems.
4. In fact, the clean start I proposed before is similar to disabling services that invoke WMI in 1. above, the clean start is based on disabling services to investigate and determine which services are causing the problem.

Clean start and clean uninstall MB is not the same program, clean uninstall MB is to prevent the third-party antivirus software has been uninstalled on the surface, but the registry and file residues still exist.

So I have these suggestions:

1. First execute according to the above 1. on the top
2. Execute the command to stop and start WMI after clean uninstalling MB.
3. Start it cleanly and find out which services it is by the dichotomy in the link. (Probably does the same thing as 1. but we can use it to be sure again)
4. If it can be solved without downgrading I think it may be more convenient, but if all other options do not work, I recommend you to try to downgrade to Windows 10 at the end of the day

I sincerely hope that the above solution will solve your problem.

I look forward to hearing back from you. 

Best Regards

Arthur Sheng | Microsoft Community Support Specialist