wmiprvsw.exe - Dangerous
wmiprvsw.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
- The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
- The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
- Exploits the Microsoft Windows Local Security Authority Service Remote Buffer Overflow (described in Microsoft Securiy Bulletin MS04-011).
The worm also spreads through backdoors that the Beagle and Mydoom worms and the Optix family of backdoors install.
The worm can also act as a backdoor server program and attack other systems.
Additionally, the worm attempts to stop the process of many antivirus and security programs.
Copies itself as %System%\wmiprvsw.exe.
Adds the value: "System Updater Service=wmiprvsw.exe
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adds the value: "System Updater Service=wmiprvsw.exe"
to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Automatic removal:
Use RegRun Startup Optimizer.