PDA

View Full Version : WMI Errors Event ID 1000



Chris Gorringe
01-12-2015, 07:38 PM
Since upgrading to 10.0.3.0, I have noticed a number of repeating errors in the Windows Application Even log:

Date: 09 January 2015 21:11:46
Event ID: 1000
Source: Application Error
Faulting application name: wmiprvse.exe, version: 6.2.9200.16384, time stamp: 0x5010ad15 Faulting module name: dstudiolsp64.dll_unloaded, version: 0.0.0.0, time stamp: 0x53f6a943 Exception code: 0xc0000005 Fault offset: 0x00000001800069ba Faulting process id: 0x4aa4 Faulting application start time: 0x01d02c50dca42314 Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
Faulting module path: dstudiolsp64.dll
Report Id: 1defea82-9844-11e4-bf31-8851fb4054bc
Faulting package full name:
Faulting package-relative application ID:
Data:

As the faulting module is the Download Studio plugin, I am assuming that this is the first place to look at resolving the problem.

Any ideas on fixing the problem?

Peter
01-13-2015, 08:17 AM
Hi Chris,
the dstudiolsp64.dll is loaded by 64 bit applications on your system, DownloadStudio uses this dll with DownloadStudio URL Sniffer. The fault indicates that wmiprvse.exe is not unloading the dll correctly and this is causing the crash. dstudiolsp64.dll has not changed since DownloadStudio version 9.0 so if you had version 9.0 running without these crashes then it is possible that the application that is calling wmiprvse is causing the problem, see http://blogs.msdn.com/b/wmi/archive/2009/05/27/is-wmiprvse-a-real-villain.aspx for some information on how to track down which application is calling wmiprvse.exe.

Chris Gorringe
01-13-2015, 06:59 PM
Thank you Peter.
I have now enabled WMI tracing and I will hopefully find out the real culprit.
:)

Chris Gorringe
01-23-2015, 06:55 PM
Hi Peter
For the last 10 days, I have enabled the WMI-Activity trace as per the MSDN blog and I have been monitoring it closely. Yesterday, I had a repeat of the error at the top of this post but there are no errors or any other information entries that relate to this problem. Can you suggest any other ways of finding out what is going wrong?

Peter
01-27-2015, 08:25 AM
Hi Chris,
does the log indicate which program has launched wmiprvse prior to the crash?

Chris Gorringe
01-27-2015, 07:18 PM
Hi Peter
The Application log, where the wmiprvse error is first seen appears to be isolated i.e. the next oldest entry is a gpupdate information entry and before that there are a number of ESENT (msiexec) information entries. In the system log, the entry prior to the wmi error is an information entry saying that the Intune Endpoint Protection is up and running and healthy. The WMI-Activity log has rolled beyond the 24/1/2015 so I have increased those log sizes to 4Mb from 1Mb to try and give you more info when the next one occurs.