Wmiprvse.exe - Application

Question

Hi!

I hope someone can figure out this nagging error that has been bugging me for quite some time. I receive this pop up error message stating: “wmiprvse.exe – application error. The instruction at “0x7c91103c” referenced memory at “0x0000000”. The memory could not be “written”.

I have done various configuration checks – including my page file settings, and no luck. I did some antivirus check, and it pass. I even check to make sure it’s resided in System32 Folder and making sure it’s Microsoft own version, and that pass as well. I just can’t put my finger on just exactly why I am getting this error message. Anyone here has a clue?

To help you further – my computer is a Dell Optiplex GX620 Dual Processor with 1GB memory chipsets (has 2 512MB chipsets), and running Windows XP Pro.

Thanks!

Krr

fireberd · Answer

Could be a real file, but could also be spyware.  See this  http://www.neuber.com/taskmanager/process/wmiprvse.exe.html

KRR1 · Answer

Hi Firebred!

I thought that too, but a quick check with Spyware Doctor shows that wasn’t the case. I even check both the Task Manager, and found nothing out of ordinary. Even my Ultimate Troubleshooter didn’t indicate a problem with wmiprvse.exe.

KRR

fireberd · Answer

Did you run a virus scan too? If not according to the referenced article you should do that.

It could be an application that is using that module and not referencing it correctly. Try to find out what program causes this.

KRR1 · Answer

Yep! I ran the Norton’s Antivirus scan as well, and nothing came up. I was wondering if I could copy the wmiprvse.exe in the C:\i386 Folder and paste it in the C:\System32 Folder to replace the “old” wmiprvse.exe. You think that would work?

KRR

fireberd · Answer

According to what I see, doing google searches, it may not be that file but some application (program) that is using the file. e.g. a program that is not using or "calling" that file correctly could cause the error.

You can try copying it over. Rename the existing file to ".old" and then copy the file to the folder. You may have to restart Windows to see how it's going to react. If you run into more problems (and you could depending on the actual version of that file) you can then delete the copied file and rename the original file back to ".exe" and get back to the original file.

KRR1 · Answer

Copy and pasting the file didn’t work. But when I read your message carefully regarding the program isn’t “calling” the file correctly – something just hit me. This normally happens when I use the Internet Explorer. I had to go find the log and see if anything is related to the problem with Internet Explorer. I had to assume it has to be the WMI issue. In the WBEM folder where the logs are – I found the following information:

Framework:

Login Warning - provider with that name already existed, overridden with latest provider login (root\cimv2:Win32_ComputerSystemWindowsProductActivationSetting) 08/22/2006 22:32:43.187 thread:3072 [d:\xpsprtm\admin\wmi\wbem\sdk\framedyn\wbemglue.cpp.2252]

Login Warning - provider with that name already existed, overridden with latest provider login (root\cimv2:Win32_ComputerSystemWindowsProductActivationSetting) 08/23/2006 18:48:19.671 thread:3916 [d:\xpsprtm\admin\wmi\wbem\sdk\framedyn\wbemglue.cpp.2252]

Login Warning - provider with that name already existed, overridden with latest provider login (root\cimv2:Win32_ComputerSystemWindowsProductActivationSetting) 08/24/2006 09:04:41.468 thread:2596 [d:\xpsprtm\admin\wmi\wbem\sdk\framedyn\wbemglue.cpp.2252]

WBE Mess

(Tue Aug 22 22:29:25 2006.44906671) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5

(Tue Aug 22 22:29:25 2006.44906671) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001

(Tue Aug 22 22:29:25 2006.44906671) : Failed the first attempt to retrieve the sink to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.

WMI will reload and retry.

(Tue Aug 22 22:32:41 2006.130156) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Tue Aug 22 22:32:41 2006.130171) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Tue Aug 22 22:32:42 2006.131546) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Tue Aug 22 22:32:46 2006.135109) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Tue Aug 22 22:32:47 2006.135968) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Tue Aug 22 22:34:41 2006.249906) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 10:07:33 2006.41822281) : Unable to remove all queries from a remote provider proxy. Error code: 800706BF

(Wed Aug 23 10:25:39 2006.42907890) : Unable to remove all queries from a remote provider proxy. Error code: 800706BF

(Wed Aug 23 10:34:42 2006.43451250) : Unable to remove all queries from a remote provider proxy. Error code: 800706BF

(Wed Aug 23 16:13:25 2006.63773859) : Unable to remove all queries from a remote provider proxy. Error code: 800706BF

(Wed Aug 23 16:15:33 2006.63902171) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5

(Wed Aug 23 16:15:33 2006.63902171) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001

(Wed Aug 23 16:15:33 2006.63902171) : Failed the first attempt to retrieve the sink to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.

WMI will reload and retry.

(Wed Aug 23 18:47:33 2006.127203) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:47:33 2006.127218) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:47:33 2006.127265) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:47:33 2006.127312) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:47:37 2006.131578) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:47:44 2006.138640) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:47:50 2006.144390) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:49:41 2006.255156) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 18:56:36 2006.670250) : Unable to remove all queries from a remote provider proxy. Error code: 800706BF

(Wed Aug 23 19:39:47 2006.3261437) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Wed Aug 23 19:40:50 2006.3323875) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:01:25 2006.51359250) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5

(Thu Aug 24 09:01:25 2006.51359343) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001

(Thu Aug 24 09:01:25 2006.51359421) : Failed the first attempt to retrieve the sink to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.

WMI will reload and retry.

(Thu Aug 24 09:04:42 2006.122937) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:04:42 2006.122953) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:04:42 2006.122968) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:04:42 2006.122984) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:04:42 2006.123000) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:04:42 2006.123015) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:04:47 2006.128562) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:04:54 2006.134750) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:06:42 2006.243234) : NT Event Log Consumer: could not retrieve sid, 0x80041002

(Thu Aug 24 09:16:45 2006.846125) : Unable to remove all queries from a remote provider proxy. Error code: 800706BF

WMIPROV

Tue Aug 22 22:36:06 2006.334750) : WDM call returned error: 4200

(Wed Aug 23 18:51:07 2006.341109) : WDM call returned error: 4200

(Thu Aug 24 09:08:06 2006.327453) : WDM call returned error: 4200

Does this gives you a clue what may have been the problem that might have affect the WMI?

KRR

FBOL · Answer

I started getting the following error message right after installing the new Dell Support Center:   wmiprvse.exe – application error. The instruction at 0x7c910f29 referenced memory at 0x0000000. The memory could not be written.   I removed Dell Support Center and the error stopped immediately.  I reinstalled it and the error returned immediately.  I ran a full NAV and no viruses were detected.  I'm using a Dell Latitude D520 with 1 GB of RAM.  I recently formatted my HD and started with a clean install of WinXP SP2.  I have installled all available MS Updates.  This is the only problem I've had since the rebuild.   Is this a known problem with the new Dell Support Center?

rjgcpa · Answer

Exact same sequence experienced by me. I installed new Dell Support Center and error message re wmiprvse.exe appeared. Uninstalled Dell Support Center and for several days and no error message. Re-installed new Dell Support Center and voila error message appears again.

Windows General

Wmiprvse.exe - Application

Was this post helpful?