Anilrgowda

My network is composed by 10 PCs client with Xp SP2.
Recently, two PCs it presents the same error generated from "wmiprvse.exe" and reported in
http://www.experts-exchange.com/Appl..._21690844.html
wmiprvse.exe - Application Error : The instruction at "0x76f61241" referenced memory at "0x00000004". The memory could not be "written".
This file is hidden and located into the folder c:\windows\system\vbem.
I have controlled with Neuber's tool Security Task Manager and spyware removal tools like SpyBt and Lavasoft but without results: the systems seem all right; but after these controls the result didn't change, the error it is always persistent.
Many thank for your collaboration.
Cordially.

------------------

Anilrgowda

Well, the description on this page says:

wmiprvse.exe Windows process - What is it?
What is wmiprvse.exe? Is wmiprvse.exe spyware or a virus?

Windows® Management Instrumentation (WMI) is a component of the Microsoft® Windows® operating system that provides management information and control in an enterprise environment. By using industry standards, managers can use WMI to query and set information on desktop systems, applications, networks, and other enterprise components. Developers can use WMI to create event monitoring applications that alert users when important incidents occur.

In earlier versions of Windows, providers were loaded in-process with the Windows Management service (WinMgmt.exe), running under the LocalSystem security account. Failure of a provider caused the entire WMI service to fail. The next request to WMI restarted the service.
Beginning with Windows XP, WMI resides in a shared service host with several other services. To avoid stopping all the services when a provider fails, providers are loaded into a separate host process named Wmiprvse.exe. Multiple instances of Wmiprvse.exe can run at the same time under different accounts: LocalSystem, NetworkService, or LocalService. The WMI core WinMgmt.exe is loaded into the shared Local Service host named Svchost.exe.
Note: wmiprvsw.exe is the Sasser worm!

And one of the comments by visitors to the above page says:

If found in windows\system32 then delete it and search for other viruses and Trojans, if its in windows\system32\wbem then check the version and that its a Microsoft file (check the properties) and this should be left where it is.

Another says:

Used by built in Windows XP firewall, ICS (internet connection sharing), Security Centre, etc, among other things. Stopping the Windows Management Instrumentation service should stop wmiprvse from running- but might also prevent firewall, ICS and Security Centre for working to. Disable it at your own risk.

------------------