What are and where are located WMI database Entries?

Question

Using autoruns from sysinternals, I found a suspect row in the tab 'VMI'

There is a Powerlog item, in the folder WMI Database Entries.

I clicked with right, and "Jump to Entry".

This opened my notepad.exe showing me the script content: so I sadly discovered it contains VERY VERY VERY BAD CODE.

I know I can simply delete the entry from inside Autoruns utility.

But I'm here to ask you: - What are WMI Database Entries - Where are them located on my disk or my registry, or whatelse?

Answer 1

From Wikipedia https://en.wikipedia.org/wiki/Windows_Management_Instrumentation

"Windows Management Instrumentation (WMI) consists of a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components provide information and notification. WMI is Microsoft's implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF). WMI allows scripting languages (such as VBScript or Windows PowerShell) to manage Microsoft Windows personal computers and servers, both locally and remotely. WMI comes preinstalled in Windows 2000 and in newer Microsoft OSes. It is available as a download for Windows NT, Windows 95 and Windows 98. Microsoft also provides a command-line interface to WMI called Windows Management Instrumentation Command-line (WMIC).

Information gathered by WMI is stored in a collection of system files called a repository. By default, the repository files are stored under %SystemRoot%\System32\Wbem\Repository. The repository is the heart of WMI and the Help And Support services framework. Information is moved through the repository by using a staging file. If repository data or the staging file becomes corrupt, WMI might not function properly. This condition is usually temporary, but you can safeguard against it by backing up the repository file manually, as mentioned above."

The data in the article below is outdated but WBEMTest is the best utility for me to browse and update WMI.

https://msdn.microsoft.com/en-us/library/ff647965.aspx

WMI Q&A: https://technet.microsoft.com/en-us/library/ee692772.aspx