What should I do if my WMI seems compromised?
Asked by
TechWhiz97
I've been digging deep into my system and found that my Windows Management Instrumentation (WMI) seems compromised. It's running random PowerShell commands, throwing errors in the event viewer, and no matter how many times I remove it, it just reinstalls and restarts on its own within minutes. I've been struggling with this for hours, going around in painful circles. It's also not letting me run Sysmon, and I can't find it in Autoruns. I'm looking for some options before I resort to wiping everything. What are my best steps?
Answers
If WMI is compromised, it's likely that the whole system at the admin level is at risk. If your machine is part of a domain, consider that all credentials might be compromised. In such cases, it might be time to nuke the system and start fresh.
Reply to this answer
I think your best bet is to back up your important data and then do a clean OS install. If possible, it might be wise to use a new SSD for the install to avoid potential issues with the old drive.
Reply to this answer
Could you share some screenshots of the PowerShell commands or any Event Log errors? My understanding is that WMI itself doesn't really do anything on its own; it's usually triggered by another program or service.
Reply to this answer
Nuking it sounds like the way to go. A fresh start could save you a lot of future headaches. Just make sure to do it with a new SSD.
Reply to this answer
Just to clarify, is it really 'compromised' or just corrupted? Those are not the same. If it's just corrupted, there might be different solutions. But I lean more towards it being corrupted, as WMI might not be valuable enough for a bad actor to target alone.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions