Closed Bug 1070123 Opened 10 years ago Closed 10 years ago

The process WmiPrvSE.exe is launched on Firefox start-up

Categories

(Toolkit :: Startup and Profile System, defect)

Product:
Toolkit
Component:
Startup and Profile System
Version:
32 Branch
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: mvocom, Unassigned)

References

Details

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0
Build ID: 20140917194002

Steps to reproduce:

Since updating to FF 32.0.2, 'WmiPrvSE.exe'' starts automatically on Firefox start-up.
It never happened in previous versions.
That doesn't happen on my system with Firefox32.0.2 and Windows7
Just installed FF 33 beta. The same result.
Any idea?

Thanks.
Another blog:
http://blog.vilmatech.com/wmiprvse-exe-consumes-high-cpu-fix-wmiprvse-exe-error/

"Installed Antivirus program causes failure

In the network marketing era, more and more operators turn to utilize web applications to promote sales. To prevent PC users from being bombarded, anti-virus programs are programmed to monitor web site, plug-ins, emails and the like, which undoubtedly puts extra pressure on a system. The help posted on Firefox forum is a good example. Decreasing the number of monitor service or updating hardware is recommended."

Which is your antivirus?
Flags: needinfo?(mvocom)
Thank you Loic. I appreciate your help.

I've read the posts. XP users reported the issue. I use Win 7, and Avast.

The only thing I changed recently is disabling System Protection (in Control Panel).
Do you think it might have anything to do with that?

Also, I happened to uninstall FF32 and install FF33 (and then reinstall FF32) a couple of times.
Something may have gone wrong.

I'd be glad if you could think of another idea.

Thanks again.
Flags: needinfo?(mvocom)
FYU: WmiPrvSE.exe isn't started on my system and i use "Microsoft Security Essentials" as Av software.
(In reply to Yaron from comment #5)
> Thank you Loic. I appreciate your help.
> 
> I've read the posts. XP users reported the issue. I use Win 7, and Avast.
I guess we have our winner: Avast.
http://www.eightforums.com/performance-maintenance/24927-wmiprvse-exe-hogging-processor-2.html#post423037
"None of these solutions satisfying me, I remembered Antivirus software use the time of your computer in their procedures to weed out malicious programs. TZres.dll dealing with timezones, I decided to investigate and VOILA, the culprit on my system is AVAST ANTIVIRUS."

Avast is probably checking websites you visit and launches this Windows process.
Try with Avast disabled or its web protection disabled.
Thank you Loic. It's kind of you.

Unfortunately, WmiPrvSE.exe starts with FF even if Avast is disabled.
I also have Pale Moon (based on FF 24) installed, and WmiPrvSE.exe does not start with that browser.
(In reply to Matthias Versen [:Matti] from comment #6)
> FYU: WmiPrvSE.exe isn't started on my system and i use "Microsoft Security
> Essentials" as Av software.

Thank you Matthias.
(In reply to Yaron from comment #8)
> Thank you Loic. It's kind of you.
> 
> Unfortunately, WmiPrvSE.exe starts with FF even if Avast is disabled.
> I also have Pale Moon (based on FF 24) installed, and WmiPrvSE.exe does not
> start with that browser.

Well, I'm running out of idea, that's all I found by searching on the web. :[
Anyway, investigating around your AV Avast is likely the best track to follow.
Hi Loic,

Thank you for your kind help.
I'll update here if I find a solution.
I'm using XP SP3 and Firefox version 32.0.2. Wmiprvse.exe starts with the program, I've verified that it does so by using Sysinternal's Process Explorer to monitor my system while starting Firefox. Not only that, but wmiprvse.exe also starts up whenever I start Thunderbird version 31.1.1. I've never run Avast on my system. Wmiprvse.exe only exists in the proper locations on my computer, all copies check out as clean on Virustotal. Malwarebytes Antimalware and Malwarebytes Antirootkit say that my computer is clean. Starting Firefox in Safe Mode doesn't stop wmiprvse.exe from starting along with it. With both FF and TB, wmiprvse.exe starts before either program's window opens. Perhaps one of either programs' coders knows why this is happening and can explain why it's necessary that wmiprvse.exe starts up whenever either program is launched?
Component: Untriaged → Startup and Profile System
Product: Firefox → Toolkit
Summary: WmiPrvSE.exe on Start-up → The process WmiPrvSE.exe is launched on Firefox start-up
Does it appear if you start an old version of Firefox? (like FF30 or older)
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/
Why is this a problem? Chances are Firefox uses some of the WMI services.
(In reply to Dave Townsend [:mossop] from comment #14)
> Why is this a problem? Chances are Firefox uses some of the WMI services.

It's a problem because I don't know *why* wmiprvse.exe starts whenever I run the current versions of either Firefox or Thunderbird. That it happens could easily be a programming mistake OR it could indicate some kind of hijacking by malware. And until a developer explains to me why this phenomena happens, I (and others) will consider it a bug. If the use of wmiprvse.exe by FF & TB is deliberate, then the easy solution to this bug would simply be to explain why it is so. I have researched this phenomena to death and have found no answers to my satisfaction. I've dicussed it in newsgroups and in Mozilla Support (https://support.mozilla.org/en-US/questions/1020749) to no avail. If this is NOT malware and isn't deliberate, then it's a bug. Frankly, I simply do not want wmiprvse.exe starting with FF & TB. It didn't used to do this and now it does. When I kill wmiprvse.exe, it doesn't seem to affect either FF or TB. In fact, they both seem to run a little faster but that might just be me.
(In reply to Dave Townsend [:mossop] from comment #14)
> Why is this a problem? Chances are Firefox uses some of the WMI services.

Some Win 7-Firefox 32 users reported that the process does not start with FF. Up until a couple of days ago, it wouldn't start on my system either. 
It's not a major issue, but I'd like to know what has caused the change.
In this discussion:

https://support.mozilla.org/en-US/questions/1020749

"OldSchoolCoder" says the following:
________________________________________________________________________
After some research and detective work I suspect this is the cause: https://bugzilla.mozilla.org/show_bug.cgi?id=921609

Also see code here: http://mxr.mozilla.org/mozilla-central/source/toolkit/xre/nsAppRunner.cpp#3363

Apparently it was added to get the BIOS manufacturer, system name and system vendor for AMD. Seriously? WMI is unnecessarily loaded because it was useful to debug one particular issue? Also why the heck is the BIOS manufacturer relevant information for a crash anyway? The 16-bit real-mode BIOS code definitely is not used by 32-bit protected-mode Windows.
________________________________________________________________________
Could you try to disable Crash Reporter in FF (see http://kb.mozillazine.org/Breakpad#Can_I_disable_Crash_Reporter.3F) and restart FF to see if the process WmiPrvSE.exe is missing?
Hi loic,

I understand from https://support.mozilla.org/en-US/questions/1020749 that disabling Crash Reporter should not affect the launching of WmiPrvSE.exe.

And yet, could you explain to me (in simple words) where and how I should add the relevant Environment variable?

Thanks.
Ok, so we have already our response. No need to test more.

CC'ing dmajor to have his opinion about that and possible (bad) consequences.
Blocks: 921609
Flags: needinfo?(dmajor)
Hi John and Yaron. I added that code. At the time, that AMD issue was one of our top sources of crashes. The crash was the result of a hardware issue on particular model CPUs and only appeared under certain timing conditions. Those conditions could be influenced by particular MSR values applied at startup by BIOS. AMD requested a breakdown of the crashes by OEM.

We didn't get a resolution on that bug, and usage of those CPUs has declined, but we're still finding the data useful for other crashes (as a proxy for system manufacturer, not necessarily the BIOS in particular).

There haven't been any changes in that area specifically for version 32. That code has been active since Firefox 27. To my knowledge it hasn't caused any problems, other than your surprise, which I hope I've addressed.
Flags: needinfo?(dmajor)
Thank you David.

Matthias (in this post) and other users say that the process isn't launched on their systems.
We use the same OS and the same FF version.
(In reply to John Corliss from comment #17)
> In this discussion:
> 

Thanks for updating here.
(In reply to Loic from comment #20)
> Ok, so we have already our response. No need to test more.
> 
> CC'ing dmajor to have his opinion about that and possible (bad) consequences.

Thanks again.
> Matthias (in this post) and other users say that the process isn't launched
> on their systems.
> We use the same OS and the same FF version.

:Matti did you select "Show processes from all users"?
 > :Matti did you select "Show processes from all users"?

shame on me, that seems to be not the case..
I have 2 x WmiPrvSE.exe that are running under SYSTEM and Network
Thank you David and Matthias. I appreciate it.
Same here. As it's the expected behavior, I close it as invalid.
Status: UNCONFIRMED → RESOLVED
Closed: 10 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.