CCleaner finding "strange" registry entries

[joeg]

I've been using the free version of CCleaner for a couple of years now, and I'd like to express my sincere thanks to Piriform for making this excellent tool available. It does what it claims it does and is relatively easy to understand and configure. I use it every night as the second-last step in my "computing day". The last step is making a Restore Point.

 

I'm now using CCleaner v.5.316105 (64-bit) on a Win7-SP1 machine with all the latest M$ updates, etc.

 

In the last couple of weeks, I've noticed that every single night when I use CCleaner's Registry Cleaner function, in addition to identifying registry entries that "make sense" to me, CCleaner finds something like this

 

It's always an "ActiveX/COM Issue", it's always in the system32 folder, it's always a .dll, and the name always has a string of letters like the one above (8-9 letters). And it's always an HKCR\CLSID key.

 

The problem is that when I run regedit and search for, e.g. in this case, bokieaim.dll, it doesn't find anything. Furthermore, when I go into my system32 folder, it doesn't find it either.

 

This is always the case, no matter what the name of the file is.

 

Furthermore, when I search for the .dll in Google, it never comes up with anything.

 

I've written the names of several of them down and there are never two with the same name.

 

I've feared might have a virus or trojan or whatever, but I have Norton Internet Security, MalwareBytes, and MS EMET. I've also run lots of "external" scans: BitDefender, MSERT, and several others. Nothing's ever found anything.

 

And on a purely subjective level, my computer, which is not "state of the art", but which has a good Samsung SSD, 12gb of RAM, and a reasonably powerful Intel Xeon CPU, is running as fast and smooth as ever.

 

Where, please, is CCleaner finding these entries?

 

Thank you.

 

P.S. This is the report from today (04 July)

[login123]

Hi, joeg. 

 

Not much action on your question. 

I tried a search for the dll file names you listed and didn't find anything either. 

Also searched for the CLSID, found nothing that looked promising. 

 

One thing you might try is this.  When CCleaner finds such an entry in the registry, right click on it and select Open in Regedit.  This will open the registry editor to the key that CCleaner found.  That might provide a clue about the software involved. 

 

Good luck, post back what you find out if you can. 

[joeg]

...

Not much action on your question. I tried a search for the dll file names you listed and didn't find anything either. 

Also searched for the CLSID, found nothing that looked promising. 

 

One thing you might try is this.  When CCleaner finds such an entry in the registry, right click on it and select Open in Regedit.  This will open the registry editor to the key that CCleaner found.  That might provide a clue about the software involved. 

 

Good luck, post back what you find out if you can. 

Thanks for taking the time to reply.

 

I've done what you suggested several times, and the result is always the same. Here's what I found today.

 

And it's always the same, except that the CLSID and the name of the .dll differ each day. And as I've said, I've NEVER been able to find even one of the .dlls on my machine.

 

It's really weird.

 

Thanks again for your reply.

[mta]

on the assumption it has only started in the last few weeks - what new software has been installed in that time frame?

go to Control Panel, Programs & Features and sort by Installed On.

 

with a name like bokieaim.dll, my first guess (and a guess is all it is) would be something to do with IE. (or some other MS product as they all use common libraries)

but that name is always changing so hell, who knows.

 

those few names you have supplied, and their random nature, suggests malware/virus-like activity to me.

I know you have done scans already, but I'd be doing them again, from Safe Mode, and getting 'second opinions' by using software not already used.

 

see Rule #10 in the Forum Rules and some good sites to get you started.

[login123]

Yep, there are some malwares that rename themselves, that was my first thought too. 

 

There are also some "good guy" malware removers that do it also, but you would probably know if you're running one of those.  . 

 

So, +1 to mta's suggestion to get help from one of the malware removal sites listed in rule #10.

 

That's sort of a long & tedious process sometimes, but it will give you peace of mind to find out nothings wrong, or if it is, fix it. 

 

Post back what you find out, if you can. Just for for information.