Scott Hanselman

Svchost.exe Sucks CPU and Rebulding the WMI/WBEM Repository

October 31, 2005 Comment on this post [5] Posted in Musings
Sponsored By

Lately I've been seeing one particular svchost.exe sucking CPU. There always a number of in-proc running inside of each of the many svchost (Service Host) instances. Using ProcEx, I figured out the PID of the specific instance. Then, I right clicked within ProcEx, hit Properties, and under the Threads tab noticed that wbemcore.dll was working REALLY hard.

Crap, time to re-schmutz WMI's repository. So, I stop WMI from the command line with :

net stop winmgmt

Then I deleted the Repository directory in c:\windows\system32\wbem\ then started again with

net start winmgmt

Then I re-stored/compiled all the .mof (Managed Object Format) files with a batch file containing this one line:

for %%i in (*.mof,*.mfl) do Mofcomp.exe %%i

Now I'm back in business.

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Hosting By
Hosted in an Azure App Service
November 01, 2005 0:43
Hey Scott, If you have time, do explain,
1) What is WMI?
2) What function does the repository serve?
3) Why did it freak?
November 04, 2005 1:16
I'd like to second that request, at least as far as why I ought to delete it all and rebuild it.

Hardware changes? Software changes? Both?
November 04, 2005 2:15
1) The purpose of WMI is to provide a standardized means for managing your computer system, be it a local computer or all the computers in an enterprise. (from MSDN) It's basically a repository for info about your system.
2) It stores all the information about your system (that has chosen to store info in WMI)
3) Dunno, I suspect I installed something that tried to store data in WMI and it went sour. It might also have gone bad since I turned off my machine suddenly one day while it was writing to disk.
November 05, 2005 8:52
I had the exact same problem, started yesterday... Strange coincidence.... The only change to my system was an automatic up date of some HP printer driver software.

Thanks for the post, timely and helpful.

P.S. I just received your new ASP.NET 2.0 book... Starting to churn thru it...

November 15, 2005 4:55
I know svchost is a general ms dll service. I was looking at the properties>thread in procEx and noticed three of my five svchost.exe were only using apvapi32.dll. This is also an important non virus related dll. But why three. Should I follow the mentioned WMI remake?

Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.