Curse

Daegul Mistweaver · Oct 31, 2005, 01:24 PM // 13:24

I don't recognise the wmiprvse.exe; it was modified back in august last, but this is the 1st I've seen of my firewall complaining about it. What gives?

C:\WINDOWS\system32\wbem\wmiprvse.exe
Parent Version : 5.1.2600.2180
Parent Description : WMI
Parent Process ID : 0x5A4 (Heximal) 1444 (Decimal)

File Version : 1.0.0.1
File Description : Guild Wars Game Client (Gw.exe)
File Path : D:\Games\Guild Wars\Gw.exe
Process ID : 0x6A0 (Heximal) 1696 (Decimal)

Connection origin : local initiated
Protocol : TCP
Local Address : bla.bla.bla.bla
Local Port : 1049
Remote Name : Auth1.ArenaNetworks.com
Remote Address : 206.127.148.48
Remote Port : 80 (HTTP - World Wide Web)

Lucifer PVP · Oct 31, 2005, 03:12 PM // 15:12

http://www.processlibrary.com/directory/files/wmiprvse/
http://www.auditmypc.com/process/wmiprvse.asp
standard windows process most of the time. I believe there is a trojan that overwrites it.
Run a virus scan

Tactical-Dillusions · Oct 31, 2005, 05:45 PM // 17:45

Note: The wmiprvse.exe file is located in the c:\windows\System32 folder. In other cases, wmiprvse.exe is a virus, spyware, trojan or worm!

Taken from neuber.com here

Alot of the system processes can display themselves as something more sinister and i often check through them and follow them all up.