NOD32 and Winmgmt.exe

Discussion in 'NOD32 version 2 Forum' started by JBravo, Sep 30, 2004.

Thread Status:
Not open for further replies.
  1. JBravo

    JBravo Guest

    I've upgraded NOD32 from 2.0 to the new version 2.12.2 and I've noticed that NOD now starts Winmgmt.exe. My recollection is that 2.0 didn't do this. It's an irritant as I try to keep unnecessary programs from running as much as possible but it's not a big deal. I was wondering what the reason for this is. It would be nice to be able to stop this though I doubt if it's possible.
    Thanks.
     
  2. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,794
    Location:
    Texas
    Are you on a network or a stand alone computer?
     
  3. JBravo

    JBravo Guest

    I'm a regular stand alone user. I'm not networked and never have been.
     
  4. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,794
    Location:
    Texas
  5. JBravo

    JBravo Guest

    Yes, I have the regular single user version of NOD. I checked my original download info and, to make sure, I checked the .exe and it's nd98enst.exe (not nd98enad.exe).
    Thank you for replying by the way. Appreciate it.
    P.S.
    OS: Winme
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Maybe you could send the file in question to Eset for analysys to exclude the possibility that it is a virus.
     
  7. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    FanJ also has the same file in use on his Win 98 machine...

    CMD = C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE -Embedding
    Curr Dir = C:\
    Started by = C:\PROGRAM FILES\ESET\NOD32KRN.EXE

    Cheers :D
     
  8. JBravo

    JBravo Guest

    I have e-mailed NOD tech-support on this and am awaiting a reply.
    From TaskInfo 2003:

    [Current Process Pane]

    CMD = C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE -Embedding
    Curr Dir = C:\
    PID/Parent PID = FFFD832D / FFFE94AD
    Started by = C:\PROGRAM FILES\ESET\NOD32KRN.EXE
    Data KB = 368 in mem = 272 in use = 144
    Code KB = 2,704 in mem = 828 in use = 224
    Handles Count = 37
    Windows = 2
     
  9. JBravo

    JBravo Guest

    NOD tech-support says they've forwarded my query to their testing and developement team and will get back to me early next week.
     
  10. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,794
    Location:
    Texas
    Thanks for the feedback.
     
  11. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    I'll add my thanks as well, keeping us informed helps other users with the same problem...

    Cheers :D
     
  12. gunnarj

    gunnarj Registered Member

    Joined:
    Jun 8, 2002
    Posts:
    80
    Thanks JBravo, for bringing this issue to the attention of Nod tech-support.

    I have the same issue with my Windows ME, i.e. NOD now starts Winmgmt.exe.

    Will be waiting for response here.

    Thanks,

    gunnarj
     
  13. Bricklin

    Bricklin Registered Member

    Joined:
    Jul 18, 2004
    Posts:
    1
    Location:
    Phoenixville, PA
    I also have Windows ME and NOD32 2.12.2 on my stand alone home PC. Winmgmt did not load before the upgrade and now it loads every time I start my computer.
    Is there any information about this? Is this a problem? Is this normal with Windows ME?
    Thanks for your help!!! Bricklin
     
  14. JBravo

    JBravo Guest

    I never recieved a response and have resubmitted my request. Just wanted to check in.
     
  15. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    The Winmgmnt service is required only with WinXP SP2, if you have another oper. system you should be able to disable its automatic startup without any side effects.
     
  16. JBravo

    JBravo Guest

    I just recieved this response from NOD tech-support:

    **********
    The winmgmt.exe is used to comunicate with the new Windows Security
    Center available in Windows XP SP2. Since you use Windows ME the process
    is not needed on your system, however, it would not cause any noticable
    slow down.

    Your Eset Team
    **********

    So it appears as if this is by design. It would be nice if this didn't have to happen on 98 and Winme systems but it's not causing me any problems.

    Thanks,
    JBravo
     
  17. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Thanks for keeping us informed JBravo, I knew it had been passed on further down the chain, and sometimes it takes a little time on its return journey ;)

    Cheers :D
     
  18. JBravo

    JBravo Guest

    Thank you Marcos.
    I would like to disable it but, offhand, I don't see how.
    Winmgmt.exe doesn't appear in the Start Menu/Startup Folder, msconfig, Startup Control Panel (Mike Lin), anywhere under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run],
    SYSTEM.INI, WIN.INI, or autoexec.bat.
    I don't see a setting for this in NOD itself, either.
     
  19. Howard

    Howard Registered Member

    Joined:
    Sep 3, 2004
    Posts:
    313
    Location:
    Wales, UK
    It may be running as a service. The following URL seems to have a number of possible solutions for you (note: I have never knowingly been anywhere near Windows ME) It centres on "WINME WBEM (WINMGMT) BUG + FIX"

    http://www.mdgx.com/me2.htm
     
  20. FanJ

    FanJ Guest

    and


    Strange... :(
    I thought there were different versions of NOD32 for Win 95-98-ME and Win NT-2000-2003-XP.

    o_O
     
    Last edited by a moderator: Oct 8, 2004
  21. JBravo

    JBravo Guest

    Thanks Howard.
    I looked over the page you provided the link for and I think I'll leave things alone for the time being. The complexities and possible consequences of the fixes probably aren't worth it for me especially as I'm not experiencing the winmgmt gradually using more and more resources problem. For me it's just sitting there using 0.01 to 0.05 percent of resources and no more.
    I was aware of the issues addressed in this page but I was not aware of any of the fixes and I found it quite informative. One of these days I'll have to take some time and start slogging through that site.
    Thanks - appreciate it.
     
  22. gunnarj

    gunnarj Registered Member

    Joined:
    Jun 8, 2002
    Posts:
    80
    Unfortunately, there is no way that I can see to stop Winmgmt from starting with the PC since it is Nod32 that is starting it.

    Can you please ask support how this can be done?

    The link/solutions that somebody else provided assumes that the Winmgmt is being started by itself or by PC Health in one of the Start services and it is not - it is being directly started somehow with the Nod32 service.

    Any help with this would be greatly appreciated, as on my Win ME machine it is slowing down the PC.

    Thank you,

    gunnarj
     
  23. Mr2cents

    Mr2cents Registered Member

    Joined:
    Sep 18, 2004
    Posts:
    497
    Hi Bricklin. I also downloaded the trial version of nod32. Like you, I also run windows me. Winmgmt loaded as soon as I downloaded nod32. My computer became very unstable. It really slowed my computer down. I'm on high speed cable, and it would take forever for a page to load. I would hit ctr-alt-delete and kill Winmgmt. However, when I did this, I couldn't even connect to the internet.

    I scanned for viruses with nod because white blanks would appear on pages. Nod didn't catch anything. So I blamed it on a bad install. I immediately uninstalled nod32. I cleaned the regeistry, and decided to download avast! free edition. After I installed avast "Winmgmt" was no longer starting up. However, my computer was still running slow. I still couldn't hardly get on the internet, and was still getting the white blanks on web pages. I then proceeded to scan with avast!free.

    Avast found a virus named "win32:kuang2" . I deleted the virus, and presto. My computer was back to normal. Nod32 missed this virus. Needless to say, I will be using another antivirus from now on. I am very disappointed in nod32. I know that no anti virus is perfect. But avast! free catching a virus that nod32 missed. :mad:
     
  24. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Placing any Anti-virus program on an already compromised computer and expecting it to find everything is haphazard at best... There are many other superior methods to use in order to first clean a system and then protect it…

    There are very comprehensive step by step instructions here in order to make sure your system is clean...

    Cheers :D
     
  25. Mr2cents

    Mr2cents Registered Member

    Joined:
    Sep 18, 2004
    Posts:
    497
    Blackspear, with all do respect, you must not have read my post :rolleyes: My computer wasn't "compromised" (your words) until I installed Nod32 :D Nod32 was the only antivirus installed on the computer at the time. It was updated and missed the virus. The computer was running great >BEFORE< I installed nod32.> AFTER < I installed nod32, the computer became, as you say compromised :cool:

    Nod32 missed the virus. That's just the way it is, sorry. :D >After UNINSTALLING NOD32< I installed avast! free, which detected the virus, and I deleted it. Computer runs great, problem solved :D

    Blackspear you assumed my system was already "compromised" your words. Blackspear you do know what they say about the word assumed don't you? :D
     
Thread Status:
Not open for further replies.