WMI provider crash

[r1man 3]

Just an update: I did a clean install of Win 10 Pro 64bit version 1909 and WMI crash happened again when doing initial scan. 

[itman 1,659]

On 7/15/2020 at 5:15 PM, r1man said:

I did a clean install of Win 10 Pro 64bit version 1909 and WMI crash happened again when doing initial scan. 

I am likewise on Win 10 1909 and EIS 13.2.15 and never seen a WMI crash in Reliability log. Might be an issue with Eset initial scanning perhaps? I have never seen it manifest on any Eset other type of scanning which I have done a lot recently in regards to testing of the long WMI and registry scan times.

Eset did push a new cleaner module via pre-release updating that might or might not fix this.

Edited July 19, 2020 by itman

[r1man 3]

When the next build for EIS will be out?

[SlashRose 25]

I don't think that a new build will come out so quickly, they will have enough to do with ironing out the zich, zich, zich mistakes, although I would think that the best solution, because the current build is really only for the trash can!

[r1man 3]

@SlashRose I still have WMI crashes even in 1909. 

I didn't run any scan, I just saw it happened in Reliability Monitor. Why it happened without running any scan? 

Does startup scan trigger that? 

Edited July 20, 2020 by r1man

[SlashRose 25]

@r1manThis has been a Windows problem for a long time and runs through various Windows 10 builds.

[Wrogg 5]

It started 1909 on mine (and previous Eset)

Still no errors with it removed?

[itman 1,659]

13 hours ago, r1man said:

Does startup scan trigger that? 

Check the WMI crash time event in Win Reliability monitor and compare to time of last startup scan shown in Eset Scheduled Task section. Best to do this right after system startup and when Eset startup task completes execution.

If WMI crash time syncs with Eset startup scan time, then we can state Eset startup scanning might be related to your WMI crashes.

[r1man 3]

@itman How to disable startup scan?

I have to disable all these depicted in red?

[r1man 3]

Or, it should be done here below?

[r1man 3]

46 minutes ago, itman said:

Check the WMI crash time event in Win Reliability monitor and compare to time of last startup scan shown in Eset Scheduled Task section. Best to do this right after system startup and when Eset startup task completes execution.

If WMI crash time syncs with Eset startup scan time, then we can state Eset startup scanning might be related to your WMI crashes.

I didn't have WMI crashes before installing EIS. Never.

[itman 1,659]

9 minutes ago, r1man said:

Or, it should be done here below?

Yes. And definitely not recommended since it is Eset's most important off-line scan.

To be determined is if ESET in ver. 13.2.15 built in limited registry scanning for this start up scan. Don't believe so since it appears Eset previous versions were already scanning select registry areas known to be abused by malware.

Edited July 21, 2020 by itman

[r1man 3]

For now, to not get WMI crashes, I will disable these two. 

You mean by disabling these, I will have chance of getting malware?

[itman 1,659]

41 minutes ago, r1man said:

You mean by disabling these, I will have chance of getting malware?

Yes.

[r1man 3]

Ok, but other parts of EIS, are working together to block malware entering my PC in the first place.

Is that right? 

I am also careful and savvy user. Marcos told that this issue of WMI crash will get resolved in the next update/version, do you have any update on that? 

Thank you. 

Edited July 21, 2020 by r1man

[itman 1,659]

2 minutes ago, r1man said:

Marcos told that this issue of WMI crash will get resolved in the next update/version

No such reply from @Marcos in this thread to this effect. Where did you see this?

[r1man 3]

Not in this thread. In other one with the title So many bugs....

[SlashRose 25]

6 minutes ago, r1man said:

Not in this thread. In other one with the title So many bugs....

It's about another problem, not about WMI crashes!

[r1man 3]

@SlashRose Anyway, both will get resolved, is that right? 

Edited July 21, 2020 by r1man

[itman 1,659]

As far as WMI crashes go, no one has posted any details in regards to the crash.

Again refer to this Technet posting: https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-common-symptoms-and-errors/ba-p/375483 . Then cross reference error codes in the article to those shown in the technical details for the associated Reliability log event.

If this new Eset version was the absolute source for these WMI crashes, everyone would be posting about it. It is possible Eset might be a contributing factor to these WMI crashes but only because previous issues exist in regards to WMI overall fitness status.

[Wrogg 5]

How many people check (or even know about) reliability monitor?

Sadly, I'll be quite honest I had used Eset since V2.5. I can't find any third party security software that works without issues any more.

Eset was always my go to.

I don't like the banking and anti theft. Or parental controls particular.

I think this was just the last straw.

[itman 1,659]

5 minutes ago, Wrogg said:

How many people check (or even know about) reliability monitor?

Anything WMI related is shown in the below Win WMI Event Log. Win Reliability Montor just shows operational events that are critical in nature.

[itman 1,659]

I did come across this interesting posting on how other software "doesn't play nicely" with Eset when it comes to WMI:

Quote

Hey there dear Rohit Raina

I was debugging this issue yesterday for 14 hours, today for 3 and I found it. WMi was incorrectly bridging communication among Eset Internet Security & Malware Bytes Premium, putting my system into turmoil. After uninstalling of MBAM, everything runs buttersmooth.

Your's was one of my first steps, although, it didn't point out to the problem. What did was trying to reset the WMi repo.

By running elevated/run as admin cmd/powershell I went through these somewhere in the half of the whole process:

1. winmgmt /verifyrepository This one told me there's nothing wrong with my WMi repo.

2. winmgmt /salvagerepository

This one told me again there's nothing wrong with my WMi repo.

3. winmgmt /resetrepository

This one told me that iP Helper & MalwareBytes services cannot be stopped. This happened in normal mode [NOT safe mode, there it simply deletes the repo, it works for one restart and that's that, back in the circle of doom of slowness].

That's what got me thinking, since Eset Internet Security, Samsung Magician and about 20 other programs which were giving out erros in event viewer, might be the culprit, since they're both AVS/AMS. [Antivirus System, Antimalware system].

Today at work I confirmed it my my mind and at home, I ran my OS without WMi service running, uninstalled the MalwareBytes Premium via Revo Uninstaller, restarted the OS, started the WMi via msconfig, and did a few restarts.

Well, the PC is blazing fast, immensly so.

Thank You kindly for Your reply, I appreciate it a lot.

With kind regards

Bryan

P.S.: Temps on my SSDs and in whole system went 10°C down. Wow, what a mess :). If I may, this is a bug on the Malwarebytes side, or Microsoft side in their WMi service? My SSDs were idling at around 45 - 50°C and so was the motherboard and CPU :/.

https://answers.microsoft.com/en-us/windows/forum/all/windows-management-instrumentation-causing-massive/4b1bff2e-b2e2-4a44-80bd-114d9c3eb712

Microsoft's recommendation:

Quote

Hi,

Thank you for writing to Microsoft Community Forums.

The issue occurs due to too many background processes running on the computer. We need to narrow down the specific process by which the system is facing performance issue.

Follow the steps and check if that helps:

Method 1: Check the process in Event Viewer.

1.    Type Event Viewer in Windows search bar and press Enter.

2.    On the View menu, click Show Analytic and Debug Logs.

3.    Go to Applications and Service Logs>Microsoft>Windows>WMI-Activity>Operational.

4.    Check the errors on right panel. In General tab, check ClientProcessID.

Now, Open Task Manager and click on Service tab. You will be able to get the process that is causing the WMI to reduce system performance on the computer.

You can uninstall the application or disable that service.

To improve system performance, I would also suggest you to refer the article: Tips to improve PC performance in Windows 10

Note: Perform all the suggestions except Reset your PC.

Please get back to us with the results.

Rohit Raina

Microsoft Community - Moderator

 

Edited July 21, 2020 by itman

[SlashRose 25]

On 7/21/2020 at 6:15 PM, r1man said:

@SlashRose Anyway, both will get resolved, is that right? 

I can not tell you, because it is actually not an Eset problem, but a Windows problem, which can only be fixed by Microsoft.

[peteyt 393]

On 7/21/2020 at 7:19 PM, Wrogg said:

How many people check (or even know about) reliability monitor?

Sadly, I'll be quite honest I had used Eset since V2.5. I can't find any third party security software that works without issues any more.

Eset was always my go to.

I don't like the banking and anti theft. Or parental controls particular.

I think this was just the last straw.

When you say you don't like them are their issues or are you just not keen on the feature? I've always found eset while it may have some features I don't use it doesn't seem to be bloated when compared to most AVs