Hijack, M$ nonsense or what?

Daegul Mistweaver

Krytan Explorer

Join Date: Aug 2005

The Incredible Edible Bookah [YUM]

W/N

I don't recognise the wmiprvse.exe; it was modified back in august last, but this is the 1st I've seen of my firewall complaining about it. What gives?

C:\WINDOWS\system32\wbem\wmiprvse.exe
Parent Version : 5.1.2600.2180
Parent Description : WMI
Parent Process ID : 0x5A4 (Heximal) 1444 (Decimal)


File Version : 1.0.0.1
File Description : Guild Wars Game Client (Gw.exe)
File Path : D:\Games\Guild Wars\Gw.exe
Process ID : 0x6A0 (Heximal) 1696 (Decimal)

Connection origin : local initiated
Protocol : TCP
Local Address : bla.bla.bla.bla
Local Port : 1049
Remote Name : Auth1.ArenaNetworks.com
Remote Address : 206.127.148.48
Remote Port : 80 (HTTP - World Wide Web)

Lucifer PVP

Lucifer PVP

Krytan Explorer

Join Date: Oct 2005

Refuge From Exile [RFE] Refuge-From-Exile.com

W/Mo

http://www.processlibrary.com/directory/files/wmiprvse/
http://www.auditmypc.com/process/wmiprvse.asp
standard windows process most of the time. I believe there is a trojan that overwrites it.
Run a virus scan

Tactical-Dillusions

Tactical-Dillusions

Desert Nomad

Join Date: May 2005

Grimsby, UK

R/

Note: The wmiprvse.exe file is located in the c:\windows\System32 folder. In other cases, wmiprvse.exe is a virus, spyware, trojan or worm!

Taken from neuber.com here

Alot of the system processes can display themselves as something more sinister and i often check through them and follow them all up.