Removing a WMI-Persistent Trojan from Windows

A step-by-step cleanup of a Trojan that uses WMI (Windows Management Instrumentation) for persistence begins with containment, not deletion. A malicious WMI event subscription can relaunch its payload after the original program is removed, making a standard uninstall ineffective.

Australian Windows setups are rarely tidy. A small business in Sydney, Melbourne, or Brisbane may combine Windows desktops, Microsoft 365, and shared local administrator rights. Before having a proper look at WMI, isolate the affected computer and protect ATO myID, online banking, and other sensitive accounts from another device.

Why WMI persistence survives cleanup

WMI persistence usually joins three objects in the root/subscription namespace: an event filter, an event consumer, and a binding between them. The filter defines when the trigger runs, the consumer contains the command, and the binding activates that command.

The payload may run through WMI as a highly privileged system process, so Task Manager can look deceptively normal. Randomised names are common, although naming alone is not proof of compromise.

Legitimate subscriptions also exist on managed business computers. WMI may be used by inventory, monitoring, or device-management software. Removing every object wholesale can break corporate tools, so inspect each chain and preserve documented ones.

Contain the infected Windows device

Disconnect Ethernet and Wi-Fi, but leave the machine powered on for now. Do not reset it, reinstall Windows, or delete unfamiliar folders, because those actions can erase useful evidence. On a work device, ask the IT administrator to isolate it through endpoint management software.

Do not use the infected computer for ATO myID, CBA, ANZ, or other online banking. Change important passwords from a known-clean device, revoke active sessions, and enable multi-factor authentication. Pc Malware Expert's malware removal guidance can help organise containment, scanning, and recovery in the right order.

Preserve copies of irreplaceable documents on clean removable storage, but exclude executables, scripts, archives, and suspicious shortcuts. If files are encrypted, retain the original media and notes. Australian businesses should also consider the Australian Cyber Security Centre's ReportCyber guidance when notifying insurers or regulators.

Identify suspicious WMI subscriptions

Open Event Viewer and inspect Applications and Services Logs > Microsoft > Windows > WMI > Activity. Enable the WMI-Activity operational log if needed, then look for repeated client processes, unfamiliar commands, or activity shortly after startup.

Use PowerShell to list the subscription objects without changing them. Run it from an elevated prompt on the isolated machine:

Get-CimInstance -Namespace root/subscription -ClassName __EventFilter
Get-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer
Get-CimInstance -Namespace root/subscription -ClassName ActiveScriptEventConsumer
Get-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding

Inspect each consumer's command line and associated filter. Paths under AppData, Temp, ProgramData, or user folders deserve closer checking, as do encoded PowerShell commands, unknown binaries, and suspicious scripts. Correlate the path with running processes, digital signatures, Defender detections, and known software before deciding what to remove. The WmiPrvSE.exe process is normally a legitimate Windows host; focus on unexpected commands and child processes.

Remove the malicious subscription chain

First record the exact filter, consumer, and binding names. You can use WMI Explorer from a trusted source for a graphical view or targeted PowerShell commands. Never delete all subscriptions as a shortcut, especially on a domain-managed work PC.

For a confirmed CommandLineEventConsumer, remove its binding first, then the consumer. Replace the example name and filter with values verified on the affected system:

$ns = 'root/subscription'
$consumerName = 'SuspiciousConsumer'
Get-CimInstance -Namespace $ns -ClassName __FilterToConsumerBinding |
  Where-Object Consumer -eq "Name=`"$consumerName`"" |
  Remove-CimInstance
Get-CimInstance -Namespace $ns -ClassName CommandLineEventConsumer |
  Where-Object Name -eq $consumerName |
  Remove-CimInstance

Remove the event filter only after confirming no legitimate consumer still references it. An ActiveScriptEventConsumer must be handled by its own class, while some campaigns use a COM consumer. Then inspect services, scheduled tasks, Run keys, Startup folders, user accounts, and recent downloads because WMI may be one of several persistence mechanisms.

Reboot while still offline and repeat the inventory. Run a Microsoft Defender scan, update the operating system, and consider an offline scan using current definitions. If ransomware also encrypted files, preserve a copy and consult the LockBit decryptor guide before attempting untrusted recovery tools.

Verify recovery and harden the device

Repeat the WMI queries after restart and watch the activity log for several minutes. Reconnect networking only when no suspicious object or payload returns. If activity continues, keep the device isolated and use professional incident response because a clean-looking folder is not enough evidence.

For a home user, update Windows, Office, and browsers from their normal sources, then restore only known-good files. For an Australian small business, check Microsoft 365 sign-in logs, rotate exposed credentials, and review privileged accounts. Report material losses through the appropriate insurer and ReportCyber pathway.

Warning signs worth checking

• Randomly named consumers linked to temporary or user-profile folders
• Repeated launches from WMI-Activity logs with unfamiliar child processes
• Unknown PowerShell, encoded commands, or newly created services

Aftercare priorities

• Patch the operating system and applications, then enable credible protection
• Reset passwords from a clean device and revoke active sessions
• Reimage Windows if the persistence chain or payload cannot be proven removed

A compact comparison separates normal managed activity from a likely compromise:

Signal	More likely legitimate	More likely malicious	Appropriate response
Subscription	Stable name tied to approved management software	Random name or consumer in a temporary folder	Preserve documented objects; quarantine and examine uncertain ones
Process	Signed deployment or inventory agent	Unknown executable or script launched repeatedly	Record its path, hash, and signature; remove with the WMI chain
Activity	Regular, explainable WMI queries	Startup trigger followed by network traffic	Keep the device offline and monitor for re-creation
Files	Normal documents remain usable	Ransom note or unfamiliar encrypted extensions	Preserve originals and assess a suitable decryptor