PDA

Click to See Complete Forum and Search --> : wmiexe.exe what is this file?

Poseidon
April 9th, 2001, 04:22 PM
I found this file running on one of our salesperson's workstation. It was located in the "C:\windows\system" directory.

Apparently it was automaticaly starting with Windows 98 SE - but where? I searched the registry under the following keys to no avail:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entversion\Run - . . .RunOnce . . .and RunServices

Also checked Win.ini and System.ini

Is this part of Internet Explorer?


After some digging I have found several 'unauthorized applications' on this workstation as well.

Looks like tonight I will pop in the customized restore cd. Thank you - Ghost. Hope she (the salesperson) does not have anything stored on her C drive that she does not want to loose.

Guess she should have thought of that before she installed the applications. It is also apparrent I will have to utilize Poledit.

TIA
Damned Angel
April 9th, 2001, 07:27 PM
if the machine has visual Foxpro installed, this is probably where it came from
3fingersalute
April 9th, 2001, 10:03 PM
Possibly a virus?

Look loading under:

System.ini under shell= ????

Also, try the reg under: HKEY_CLASSES_ROOT\exefile\shell\open\command
Poseidon
April 10th, 2001, 11:16 PM
Originally posted by 3fingersalute:
Possibly a virus?

Look loading under:

System.ini under shell= ????

Also, try the reg under: HKEY_CLASSES_ROOT\exefile\shell\open\command


Virus -that was my thought as well (even though I am running NAV Corp Edition 7.5).
I searched the rest of the workstations (and both servers) and did not find any other occurrences of the file. Whatever it was, it's gone now.
My guess is it was either a virus or from one of the personal applications she installed. BTW guess who was not a happy camper today when she came to work and found her workstation wiped clean and locked down? " . . but I had all my programs on there!". Can't say I did not warn everyone.

I did not think to check under the HKEY_CLASSES_ROOT\exefile\shell\open\command
key. If it surfaces again I will be sure to look there.

Thanks for the responses.
Damned Angel
April 11th, 2001, 01:39 AM
muahahahahah
I love the look on their faces when all their data are belong to me.
3fingersalute
April 11th, 2001, 06:45 AM
Originally posted by Damned Angel:
I love the look on their faces when all their data are belong to me.

ROFLMAO!!