General discussion

Locked

sudden long boot on Thinkpad

By tedkrever ·
My two month old Thinkpad Z60M, which booted fast two weeks ago, is now taking three minutes or more. It seems to stall as the desktop image appears for thirty to fifty seconds. Running Task Manager shows svchost taking a little memory occasionally but nothing much. When the taskbar finally appears, the first file that shows in Task Manager/Processes is wmiprvse.exe, if that's helpful. As soon as this loads, bootup proceeds quickly.
Before this started, I had updated some Thinkvantage software off the Lenovo site and bought the Diskeeper defrag program that came (lite version) with the machine. But I removed the only piece of Thinkvantage that was new (Rescue and Recovery) and disabled the other new bits and the Diskeeper at bootup without bootup improving. So I'm stumped.
Any suggestions?

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

RE: Long Boot

by DugaDugDug In reply to sudden long boot on Think ...

Have you scanned it for spyware as well as viri? The service you mentioned, wmpiprvse.exe, has to do with Windows Instrumentation Managment however take a look at the following and see if this is what is on your system:

http://www.sophos.com/virusinfo/analyses/w32sonebotb.html

Collapse -

please clarify something for me...

by tedkrever In reply to RE: Long Boot

Yes, I searched and found a second instance of the file in I32 and renamed it. But I don't have one in System32--only in System32/wbem which I understand is the legitimate place for it to be.

I use Microsoft anti-spyware on the laptop. It says I'm clean.

Collapse -

Suggestion

by BFilmFan In reply to sudden long boot on Think ...

Windows? Management Instrumentation (WMI) is a component of the Microsoft? Windows? operating system that provides management information and control in an enterprise environment. By using industry standards, managers can use WMI to query and set information on desktop systems, applications, networks, and other enterprise components. Developers can use WMI to create event monitoring applications that alert users when important incidents occur.

In earlier versions of Windows, providers were loaded in-process with the Windows Management service (WinMgmt.exe), running under the LocalSystem security account. Failure of a provider caused the entire WMI service to fail. The next request to WMI restarted the service.
Beginning with Windows XP, WMI resides in a shared service host with several other services. To avoid stopping all the services when a provider fails, providers are loaded into a separate host process named Wmiprvse.exe. Multiple instances of Wmiprvse.exe can run at the same time under different accounts: LocalSystem, NetworkService, or LocalService. The WMI core WinMgmt.exe is loaded into the shared Local Service host named Svchost.exe.
Note: wmiprvsw.exe is the Sasser worm!

Note: The wmiprvse.exe file is located in the C:\WINDOWS\System32\Wbem folder. In other cases, wmiprvse.exe is a virus, spyware, trojan or worm!

Collapse -

I saw this, thanks

by tedkrever In reply to Suggestion

Yes, I found a second instance in the I32 folder and renamed it. Which didn't solve my problem.

Back to Windows Forum
4 total posts (Page 1 of 1)  

Related Discussions

Related Forums