WMI Provider Host taking up all of CPU

Anonymous
2024-08-20T22:53:25+00:00

Hey! I have got a new build - Ryzen 7950x w 128GB RAM and a NVIDIA 4060 GPU. Motherboard: ROG STRIX X670-E-E GAMING. Main problem I have been facing is the WMI Activity levels for the CPU were getting up to 80-90% clogging the functionality of my PC.

My previous details about how it started and the intensity of the problem: https://answers.microsoft.com/en-us/windows/forum/all/wmi-provider-host-high-cpu-usage/da16f098-ec32-45ba-8527-3a080f37ab7b

Now, I have managed to execute some solutions mentioned in the above linked post and then some routes I have mentioned properly in this sheet I made for the same purpose; the major route I have chosen is to take note of PID's in Operational Logs of WMI Activity and tackle them one by one.

Details here: https://docs.google.com/spreadsheets/d/1QZ1BLoRiwY9USNcwSJb2dpQGacYCu\_XnusYGnH10jJA/edit?usp=sharing

I have marked the processes that have been "solved" and did not occur again as green and the ones still coming up as errors in the operational logs as red.

The processes giving me WMI Errors in a ranked manner in terms of frequency of errors:

  • NVIDIA Container
  • ASUS COM Service
  • ExpressVPN - VPN Service
  • Service Host Network Service

The situation as of now is it's gotten better; the WMI Activity doesn't go more than 20% as of now but as far as I know, this process shouldn't take up any of the CPU which means some programs/processes are still interfering which I want to fully solve. Also, there have been periods of no issues and then suddenly it crops up again so I want to fully eliminate it.

Also let me know; my last resort being a reboot to downgrade to Windows 10 and how would that fare as the last possible solution if I can't figure out how to eliminate the interfering programs/processes?

Thank you, eagerly waiting for a response. :)

Windows for home | Windows 11 | Devices and drivers

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Ramesh 181.9K Reputation points Volunteer Moderator
2024-09-28T17:17:01+00:00

Thanks. The PML can now be unshared (for privacy reasons).

The following app is causing the issue.

"C:\Program Files\Adda52_2.0\Adda52_2.0.exe"

Please terminate the app, uninstall it, or rename the executable.

Was this answer helpful?

0 comments

54 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2024-09-28T17:02:52+00:00

    Didn't quite get how to "reset filters".

    Did the rest of it, do let me know if it needs to be done again.

    Logfile.zip

    Was this answer helpful?

    0 comments
  2. Ramesh 181.9K Reputation points Volunteer Moderator
    2024-09-28T14:34:52+00:00

    Here are both the links:

    FRST.txt

    Addition.txt

    When the WMI usage shoots up, please run a ProcMon trace and share the zipped log on OneDrive.

    1. Download Process Monitor: http://live.sysinternals.com/procmon.exe
    2. Launch Process Monitor.
    3. Reset the filter options and click OK.
    4. If tracing does not start automatically, press Ctrl + E.
    5. Run the trace for 90 seconds.
    6. After 90 seconds, switch to Process Monitor and stop tracing (Ctrl + E).
    7. Save "All Events" in a PML log file.
    8. *Zip* the log file and upload it to your OneDrive.

    The PML log size will be huge. Zipping it reduces the size by 90%.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2024-09-28T14:25:40+00:00

    Here are both the links:

    FRST.txt

    Addition.txt

    Was this answer helpful?

    0 comments
  4. Ramesh 181.9K Reputation points Volunteer Moderator
    2024-09-28T03:23:40+00:00

    That log was helpful. Please run the Farbar Scanner and share your logs on OneDrive.

    1. Download Farbar Recovery Scan Tool 64-bit (FRST64.exe)

    https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot: https://learn.microsoft.com/en-us/deployedge/media/microsoft-edge-security-download-interruptions/dowload-was-blocked.png

    1. If the OS language is non-English, rename FRST64.exe to FRST64English.exe.
    2. Run the program. Don't check or uncheck any options. Click "Scan".
    3. Zip the two logs, FRST.txt and Addition.txt, upload them to your OneDrive and share the link here.

    How-To: Share OneDrive files and folders - Microsoft Support

    https://support.microsoft.com/en-us/office/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    OneDrive sharing options - screenshot

    https://imgur.com/a/vZyxpY9

    Was this answer helpful?

    0 comments