0

Today I discover that WmiPrvSE.exe is changing my DNS settings on my main NIC at each startup. The following is an extract from Security event viewer following my registry Audit :

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4657</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12801</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8020000000000000</Keywords> 
  <TimeCreated SystemTime="2016-05-19T22:17:28.512119300Z" /> 
  <EventRecordID>237958</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="212" /> 
  <Channel>Security</Channel> 
  <Computer>Narus-PC</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-5-18</Data> 
  <Data Name="SubjectUserName">NARUS-PC$</Data> 
  <Data Name="SubjectDomainName">WORKGROUP</Data> 
  <Data Name="SubjectLogonId">0x3e7</Data> 
  <Data Name="ObjectName">\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{0D87D42F-9740-4A6A-AA21-E48D267CCB3C}</Data> 
  <Data Name="ObjectValueName">NameServer</Data> 
  <Data Name="HandleId">0x2fc</Data> 
  <Data Name="OperationType">%%1905</Data> 
  <Data Name="OldValueType">%%1873</Data> 
  <Data Name="OldValue">8.8.8.8,8.8.4.4</Data> 
  <Data Name="NewValueType">%%1873</Data> 
  <Data Name="NewValue">31.7.56.104,119.81.242.146</Data> 
  <Data Name="ProcessId">0xf2c</Data> 
  <Data Name="ProcessName">C:\Windows\System32\wbem\WmiPrvSE.exe</Data> 
  </EventData>
  </Event>

I had some fun few months ago with DNS tools like OpenDNS, OpenNIC, DNSCrypt, Unbound etc ... also I installed ProXPN. My goal was to study DNS leaks while on VPN and discovers tools that allow to perform DNS request securely.

Anyway, I uninstalled everything a long time ago, as properly that possible (as far as I know). But I suppose it is related to my issue.

I suppose WmiPrvSE.exe is just doing his job becaused something else saked to change DNS, and it's not the root cause, right ? How can I investigate deeper ? How can I prevent this to happen ?

Kind regards, Narus !

1 Answer 1

1

so after all I had a "proXPN VPN" service remaining. Every time I restart the service, my network configuration revert back with the same incorrect settings. So I installed proXPN again et uninstalled it using CCleaner. Now the "proXPN VPN" service is gone, and everything is fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.