wmiprvse.exe (wmiprvse stands for Microsoft Windows Management Instrumentation ) is a generic process that manages clients in Windows XP. It is automatically launched the first time a client application connects, and is used to monitor system resources.
It is an essential system process which may not be terminated.
However, it may also be the Trojan horse W32/Sonebot-B, which creates a copy of itself in the folder %Windows%\System32, with the filename WMIPRVSE.EXE. The following entry in the registry confirms that the Trojan is present:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Kernel_check = wmiprvse.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Kernel_check = wmiprvse.exe
