Jump to content

WMI Provider Host using lots of CPU space - virus?

Recommended Posts

Hi -

My computer has been running slowly, with occasional spikes in CPU usage. A program called WMI Provider Host is at the top of the Processes list in task manager. I did some searching and found several sites that say this *might* be a virus. I found a similar thread on here (http://forums.malwarebytes.org/index.php?showtopic=110649). Would you be able to help me figure this out? I'm running Windows 8. I also work remotely for my job using a program called Citrix. (Maybe that's part of the issue?)

Many thanks,


Link to post
Share on other sites

Hello Catherine and welcome to MalwareBytes forums.

My name is Maurice Naggar.

I will be helping you today.

Please do a backup of any documents/personal files that you cannot afford to lose.

If this is not your computer, or if it belongs to a company or organization then please Stop and tell me.

I'll need more information to locate the source of the issue.

Start NOTEPAD. Check and make sure "word wrap" is off.

From Notepad main menu bar, Select F (format) and make sure Word Wrap is NOT checked.

IF it -is- checkmarked, click that one time so that it is un-checked.

Close / exit Notepad.

When you look at Task Manager and the Processes tab, what does the CPU % show at the very top of the CPU column?

To show all files:

  • Press and hold Windows-key & then press R key to get the RUN menu.
  • Type in

    and press Enter

  • When in Windows Explorer, press ALT-key then V key to get VIEW menu
  • Look at the top ribbon, right side. {the Show/Hide block}
  • Look at the line Hidden items. IF it has no checkmark, then Click the box one time so that it is checked.

  • Download & SAVE to your Desktop Tigzy's RogueKiller >> from here << or
    >> from here <<
  • Quit all programs that you may have started.
  • Please disconnect any USB or external storage drives from the computer before you run this scan! i_arrow-l.gif
  • For Vista or Windows 7 / 8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.
    For Windows XP, double-click to start.
  • When prompted to accept the EULA, please do so.
  • Wait until Prescan has finished ... i_arrow-l.gif
  • Then Click on Scan button at upper right of screen.
  • Wait until the Status box shows "Scan Finished"
  • Click on Report and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[1].txt on your Desktop
  • Do NOT press any Fix button.
  • Exit/Close RogueKiller

Download DDS and save it to your desktop from http://download.bleepingcomputer.com/sUBs/dds.com here

or http://download.bleepingcomputer.com/sUBs/dds.scr or


Disable any script blocker if your antivirus/antimalware has it.

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Double click dds to run the tool.

DDS will run in a command prompt window and will take 3 to 4 minutes or so.

Follow and answer the prompts as appropriate.

  • When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt
  • Save both reports to your desktop.

Please Copy & Paste contents of the following logs in your next reply:



Use NOTEPAD to Copy all contents of each log, then Paste directly into main-body of reply box.

Do -not- use the attach option unless a single log is way-too-large & won't fit.

ALSO, know that "slow computer" is -not- necessarily a definitive sign that malware is onboard.

Here are some recommended articles:

MS Speed up your pc - Win7 / Vista


What to do if your Computer is running slowly


See Miekiemoes' Help! My computer is slow!


NOTE: Should there be no malware found as we move along, I will then point you to the topic resources just noted above.

The charter of this forum is to provide malware removal help.

Link to post
Share on other sites

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.