How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file


Description:

Troj/Banker-EPN is a Trojan that attempts to steal accounts, passwords, and other online banking related information.  This infection listens to the traffic that you send to online banking web sites, and when it finds certain information, records it and sends it to a remote location.  This information is then used to either perform identify theft or to sell it to those who will.

Once this infection is installed, it will create the C:\Windows\wmiprevse.exe file and then add the following registry key so that it runs automatically when you start Windows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”wmiprevse” = “C:\Windows\wmiprevse.exe”

If this infection is found on your computer, it is strongly suggested that you contact all of your banks and have your account information changed immediately.  Also by explaining the situation they can have your accounts monitored for illicit activity.

Manual Removal Instructions for Troj/Banker-EPN:

End these processes if they exist:
Learn how to end processes

wmiprevse.exe


Delete these files if they exist:
Lean how to remove files

C:\Windows\wmiprevse.exe

Remove these Registry keys if they exist:
Learn how to remove Windows Registry entries

Warning: Editing the Windows Registry incorrectly can cause problems with your computer that may cause it not to operate correctly.  Please edit the Registry only if you know what you are doing.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”wmiprevse”

del.icio.us:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  digg:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  spurl:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  wists:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  simpy:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  newsvine:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  blinklist:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  furl:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  reddit:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  fark:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  blogmarks:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  Y!:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  smarking:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  magnolia:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  segnalo:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file  gifttagging:How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file

This entry was posted on Monday, March 9th, 2009 at 1:42 pm and is filed under Malware Removal Guide, Tutorial. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

One Response to “How to remove the Troj/Banker-EPN infection and the wmiprevse.exe file”

  1. Ellie Hughes Says:
    May 24th, 2010 at 11:16 pm

    Identity Theft is so rampant these days because it is quite easy to harvest information from someone else.`.-

Leave a Reply