Wmiapsrv.exe and so on are infected with win32.iuhzu. A, which causes blue screen during Windows XP startup?

Wmiapsrv.exe and so on are infected with win32.iuhzu. A, which causes blue screen during Windows XP startup?

EndurerOriginal
2007-10-221Version

This morning, a colleague said that his work could still be used normally last night. Today, the blue screen is turned on, and the restart failure still persists, so I can help you check the problem.

Restart your computer, press the F8 key, and select "Last correct configuration" from the displayed boot menu"

The system starts smoothly and enters the desktop.
When you enable the Kaka security assistant check, rising file monitoring prompts you to find the virus:
/---
Virus name processing result scan method path File
Win32.iuhzu.Successfully cleared file monitoring C:/Windows/system32/WBEM wmiApSrv. exe
Win32.iuhzu.Successfully cleared file monitoring C:/Windows/system32/WBEM wmiprvse.exe
---/

These two files must be system files ~

Use pe_xscan to scan logs and analyze the logs to find the service:
/---
Pe_xscan 07-08-30 by Purple endurer
2007-10-22 10:50:49
Windows XP Service Pack 2 (5.1.2600)
Administrator user group

O23-service: wmiApSrv (WMI Performance Adapter)-C:/Windows/system32/WBEM/wmiapsrv.exe || MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | WMI Performance Adapter Service | (c) Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Wmiapsrv.exe (manual)
---/

The corresponding wmiapsrv.exe file has just been modified. Is it infected?

Disable real-time monitoring by rising, restore two files from the quarantine area, and use Kaspersky for online scanning. The results are as follows:

Scanned file: wmiapsrv.exe-infected

Wmiapsrv.exe-infected by Trojan. win32.patched. v

Scanned file: wmiprvse.exe-infected

Wmiprvse.exe-infected by Trojan. win32.patched. v

Disable the wmiApSrv service first.

Check whether the rising star in the current version is 2007, and the virus database is from October 14 to 2008.

After the upgrade, restart your computer as prompted to go to the desktop ~