Full Version of this article can be found here


What is it?
Windows Management Instrumentation Provider Host program - wmiprvse.exe

What does it do?

Here's a direct quote from MS about this: (source)
Effective management of PC and server systems in an enterprise network benefits from well-instrumented computer software and hardware, which allow system components to be monitored and controlled, both locally and remotely. Microsoft is committed to simplifying instrumentation of hardware and software under Microsoft? Windows? operating systems. Microsoft is also committed to providing consistent access to this instrumentation for both Windows-based management systems and legacy management systems that are hosted in other environments.

In Win98/NT/2000 this is a seperate process whereas in XP it is a part of svchost

More Info
More Info

See Also wmiexe.exe

Virus Precaution:
The original file from Microsoft gets placed in the Located at C:WINDOWSSystem32wbemwmiprvse.exe . If you find it anywhere else then you should be suspicious for sure.

You'll want to keep an eye on this google search for any known viruses.


W32/Sonebot-B @ Sophos.com