Why a constant WMI process since Patch 2.7.10?

Morimizo

Since Patch 2.7.10 (the one with the new privacy settings and 3rd party advertising), I've noticed a constant drain on the CPU of 1-2% by a WMI provider host process, even when logged off of ESO. If I suspend this process (it cannot be ended--just starts again immediately), I can't even get to the initial Bethesda screen of ESO (only greeted with a black screen and no music); but can access anything else online or utilize any other software offline.

Could this be a program that is collecting and sending information about my activities on the PC, even when not logged in to the game? I don't believe that was part of the new ToS we had to accept, and shouldn't be. I understand you require info to be collected WHILE a player is on your service, but have to wonder if this is one of the causes of folks (including myself) being kicked to the login screen more often of late.

Can anyone please offer some insight?

Betheny

Ok it shouldn't be constantly running as far as I can tell, should only run for a bit at startup. Nor should it be using any noticeable amount of your CPU.

Some viruses can mimic the process so you might want to do a bit of spring cleaning there. Also some applications can cause it to pop up, in one of the links below the culprit was found to be Avast Antivirus.

Read this link

Also read this link

Both links might help you figure this out.

Betheny

You sure it's not Windows Update?

Morimizo

Betheny wrote: »

You sure it's not Windows Update?

Pretty sure; I disable that until ready to manually get the updates. Their shenanigans with the Windows 10 nagware embedded inside an "Important Security Update" prompted this reaction. Of course, knowing Windows, it probably runs anyway, even though it's off.

If the program wasn't linked to ESO, I'd be more likely to believe this was happening, but thank you for the suggestion.

Betheny

It's not running on my computer as far as I can tell, have you got the service name just to check?

Morimizo

Betheny wrote: »

It's not running on my computer as far as I can tell, have you got the service name just to check?

Sure, it's "WmiPrSE.exe" It's a network executable, and the description is WMI provider host.

It is just very strange that if I suspend the process, ESO won't boot, but when I resume it, boots up normally. The process is ongoing, no matter what I am doing on the PC; whether idle (which is why I noticed it in the first place), on a different game (it does happen from time to time---lol), or checking the weather online.

Thank you for checking to see if it is happening on your PC as well, I appreciate it!

Adoman

Is this your personal computer or a work computer? WMI is commonly used by management products like Microsoft ConfigMgr. I can't imagine why it would interfere with ESO unless there was some monitoring going on.

Morimizo

Betheny wrote: »

Ok it shouldn't be constantly running as far as I can tell, should only run for a bit at startup. Nor should it be using any noticeable amount of your CPU.

Some viruses can mimic the process so you might want to do a bit of spring cleaning there. Also some applications can cause it to pop up, in one of the links below the culprit was found to be Avast Antivirus.

Read this link

Also read this link

Both links might help you figure this out.

Thank you @Betheny and @Adoman for your suggestions! I did some more digging, and while it certainly could be a virus masquerading as the process in question, it seems that usually happens when the file is located in a different folder than the legit WBEM one. Always worth scanning for that anyway, though.

I believe that you are right that an Antivirus program is the culprit; last night AVG performed a huge update which changed the UI and added some more options to the settings. I turned off the "participation in the AVG community" which was not available to remove before, and the WMI is quiet now. Yay!

I would imagine that ESO may use the same WMI while logged on for data sharing or some such, which is why it wouldn't run without it. I definitely thought it would be strange that ZOS would agree to have ALL our PC activities observed outside of their software, and hope I didn't come across as accusatory, just mystified.

Thanks again for your help!

Morimizo

Ugh..never mind, it's back, as soon as I closed the browser. Sheesh.

Betheny

I just checked again and it's still not running on my computer. You should get Process Explorer (which will do the job fine) or if you have time and patience Process Monitor and hunt down whatever is on your system that's bringing it up.

Morimizo

Betheny wrote: »

I just checked again and it's still not running on my computer. You should get Process Explorer (which will do the job fine) or if you have time and patience Process Monitor and hunt down whatever is on your system that's bringing it up.

Thank you for checking again, and I'm glad it's not happening uniformly to all ESO players, that helps narrow down the culprit.

I went through the motions of making sure it wasn't the AV (which it isn't), and at least can now shut off the WMI by locating and ending its svchost.exe. Thank you for the recommendation of Process Explorer, I will check into that.

In the meantime, Happy Gaming!