WMIPRVSE.EXE?

[Rilla927]

I have two entries in OP FW of wmiprvse.exe so I done a search for this file and the search came up with 8 of them. Do you guys have this many? Is this normal? Also it asked for direct disk access through OP and I blocked it.

[Cudni]

Assuming it is not some malware (probably not but double check if uncertain) allow it access in OP

[Hel]

Imho, it looks suspicious to me. Geniune should locate here C:\Windows\System32 wmiprvse.exe (http://www.file.net/process/wmiprvse.exe.html) but you have several from different folders.

[Rilla927]

I'm using vista so I don't know if that is usual.

[ABee]

-{ Quote: "I'm using vista so I don't know if that is usual." }-
Apparently it's not. (I'm not overly familiar with Vista.)

You have the actual 'wmiprvse.exe' in system32/wbem, right where it's supposed to be.
You have 'prefetch' listings. (Multiple, but probably for the same reason as below.) Nothing unusual about that.
You have listings for the 'Windows Side by Side' folder (winsxs). Nothing unusual there, either:

221818

https://www.faultwire.com/file_detail/wmiprvse.exe*41939.html

I imagine it's the different .dlls in the SxS folder being called by wmiprvse.exe that gives you the multiple firewall entries.

[Rilla927]

Thanks Abee. I guess that explains it.