deleted wmiprvse.exe

[Guest]

Call me stupid. Stupid is as stupid does my mama used to say.

Friend's Dell running XP SP2 is infected with spywarequake.

So I run my usual adaware and spybot and hijack this stuff but to no avail.

So I hit Ctrl Alt Delete to view running processes and notice this file
called wmiprvse.exe poking in and out so I'm thinking this is a bad guy.

Did a search on the hard drive for all instances of this file and deleted
them all.

Shortly thereafter got a message saying some important files in Windows have
been deleted and that I need to insert the Windows XP sp 2 disk to recover
them.

Well this friend only has a Dell Windows xp sp1 disk and this didn't work.

Also as a result, when I open IE6, the windows opens but it will not
navigate to any sites at all.

I am stuck

Please advise.

 

[AZGLI]

I would restore the file from another computer into the following
directory:
C:\WINDOWS\system32\wbem

This is the only instance that should be installed. You can recover it
from another WinXP computer and just copy it into the directory.

If you found it in another directory, it was the Sasser worm.
http://www.neuber.com/taskmanager/process/wmiprvse.exe.html

If you need a copy, let me know and I will email you a copy of the
file.

HTH.

 

[Guest]

How did you delete the file? Is it in your recycle bin and can be restored
from there? Have you tried restoring to a point previous to your deleting
the file? I believe it should be located in C:\WINDOWS\System32\wbem\ and I
can't remember if it would be included in a restore point, but worth a shot.
If it was located anywhere other than that, it could be sasser.

 

[Marian Gutu]

hello
start, run, msconfig. click on expand file.
restore the missing file from any windows xp cd to c:\windows\system32\wbem
then finish by running sfc /scannow
regards,
--
Marian Gutu

MCP, MCSAs, MCSEs
Be nice, society already sucks!

May the Force be with you!
http://www.google.com