Recurring Sys/WOw64 with Different Dlls

CCleaner for Windows
1

Every time I run CCleaner on the Registry other than the same day, some version of Wow64 shows up. I have scanned for viruses and malware using Norton Security Suite, Norton Power Erasure, Microsoft Malicious Software Tool, Malwarebytes Anti-Malware, Spybot - Search & Destroy 2, and have additional protection with Spyware Blaster and found nothing. Yet some version of Wow64 always reappears after a CCleaner scan and deletion of the file. I tried to look it up on Goggle and get no document found. Are the versions that I copied and saved as text before I deleted them a virus?

ActiveX/COM Issue InProcServer32\%SystemRoot%\SysWow64\cecnazzzddoi.dl

HKCR\CLSID\{BB6D44FF-00D0-6B1D-50CB-47CBA4B253C5}

ActiveX/COM Issue InProcServer32\%SystemRoot%\SysWow64\vmwrba.dll

HKCR\CLSID\{BB6D44FF-00D0-6B1D-50CB-47CBA4B253C5}

2

Same answer really as you were given over at the Microsoft forums. Don't use the registry cleaner if you don't know what things are

http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/is-this-version-of-wow64-a-virus/1b3c3310-fb2d-48a6-aa54-9be8b1c53d75

If you are worried about being infected go to one of the sites mentioned in item 10 of this link.

https://forum.piriform.com/index.php?showannouncement=15&f=4

3

with all your scans, you can assume (as safely as any of us can) that it is not re-appearing due to malware/infections.

so, eliminating the most likely, that only leaves the possibility it's being re-generated by MS.

my guess, all normal, completely safe, just unexplained, like most things are when you start digging around areas best left alone.

4

also another thread here by same user; http://answers.microsoft.com/en-us/windows/forum/windows_7-security/is-syswow64vmwrbadll-a-virus/cd353568-1dfc-4e87-90af-afced21323fb

and someone else here; http://www.askbeen.com/811569/windows-7-is-syswow64-vmwrba-dll-a-virus

quiet a few in fact; http://shmimicros.com/windows-7/248458-Is-SysWow64-vmwrba-dll-a-virus

bit phishy...

5

Same answer really as you were given over at the Microsoft forums. Don't use the registry cleaner if you don't know what things are

http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/is-this-version-of-wow64-a-virus/1b3c3310-fb2d-48a6-aa54-9be8b1c53d75

If you are worried about being infected go to one of the sites mentioned in item 10 of this link.

https://forum.piriform.com/index.php?showannouncement=15&f=4

Thanks for the quick reply. Can you suggest how I can know what things are?

6

Upload the .dlls to virustotal to see if there are any hits.

https://www.virustotal.com/

7

Thanks for your reply. The first and third links are mine but the second is not ...

8

Upload the .dlls to virustotal to see if there are any hits.

https://www.virustotal.com/

Thanks for the site. No hits on the last four dlls but I never had them show on Ccleaner before. Is there away I can determine where the dlls came from or associated with what program? I Googled the dlls associated with Sys/Wow64 and no document was found...

9

if standard naming convention can be believed, vmwrba.dll would suggest something to do with virtual machine software.

do you run or have installed any type of sandboxing, virtual PC software?

10

if standard naming convention can be believed, vmwrba.dll would suggest something to do with virtual machine software.

do you run or have installed any type of sandboxing, virtual PC software?

To my limited knowledge, I do not have any virtual PC software. I searched and discovered a forum that had the question: ’”How can I find out what program installed using a specific DLL file?”, and one answered:

“Process Monitor can do this for you. Just filter by the DLL's name and when a program tries to load it there will come an entry, which mentions which process is looking for and/or accessing the DLL you mentioned.

You should also try to do a boot log (enable boot logging in the menu, then reboot and open process monitor again) which is necessary to catch programs and services that load it upon boot.”

https://technet.microsoft.com/en-us/sysinternals/bb896645

Since this SysWow64 file would reappear with a different DLL after scanning the registry once a week for the last three weeks, I searched for a tool that would show DLLs on my system to see if the ones I deleted were on the list. Then, I guess, I could determine if Windows 7 was regenerating them and therefore needed and appropriate

https://technet.microsoft.com/enus/sysinternals/bb896656.aspx.

Why I am bothering with this because I read on Google search that a virus would lurk in the SysWow64 folder and do damage to the system but I did not see any problem following their instruction:

http://blog.qisupport.com/syswow64-trojan-removed-manual-guide-remove-trojan-horse/.

What is your opinion?

11

my personal opinion.....

the vmwrba file looks OK, the cecnazzzddoi one, purely from the name - who can say.

it sounds like you have scanned the holy crap out of your PC, so you can have some sort of confidence there are nothing nasty.

many items get re-created after cleaning, by the system, and I think those two are just that.

in CC you can right click on them and Add to Exclude list - out of sight, out of mind. :)