The actual high-level query is in part one and in the first reply, but I think your real question is "why did they want to scan the address space of every proce

The actual high-level query is in part one and in the first reply, but I think your real question is "why did they want to scan the address space of every process on the system?" I think that the answer is that they didn't. That was just one of the bazillion counters that came along for the ride. I believe that that counter has been removed in the latest OS, thus squishing this bug in another way. I don't understand WMI, but it sounds really weird. One peculiarity is that once some program asks for counters "WMI refreshes the list of counters every 2 minutes until the WMI helper process closes due to inactivity." So that's great. IT asks for some data, they get memory scans that they don't want, and those scans are repeated every two minutes for a while (ten minutes?) even though nobody is looking at the results.