XPS 410 Runtime Error wmiprvse.exe

Start >> RUN >> Regedit and look for the issues noted at this link to see if you have a virus that masquerades as this file:

http://www.sophos.com/virusinfo/analyses/w32sonebotb.html

========================

This section helps you to understand how it behaves

W32/Sonebot-B is a network worm which includes IRC bot and backdoor functionality that allows unauthorised remote access to the infected computer.

This worm copies itself to network shares with weak passwords, initiates a remote background process, connects to a remote IRC server and joins a specific channel.

W32/Sonebot-B drops a copy of itself to the Windows System32 folder with the filename WMIPRVSE.EXE and sets the following registry entries to run the copy on system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Kernel_check = wmiprvse.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Kernel_check = wmiprvse.exe

W32/Sonebot-B also attempts to terminate a number of processes and delete a number of files from the infected computer.

This worm may also set the following registry entries:

HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\
AutoShareServer =
AutoShareWks =

HKLM\System\CurrentControlSet\Control\lsa\
RestrictAnonymous =
RestrictAnonymousSam =

========================

Message Edited by walts0042 on 04-07-2007 02:15 PM