Error: SysWOW64\winvnc86.exe missing

[ManicWolf]

So recently whenever I start up my computer this message pops up:

"C:\Windows\SysWOW64\winvnc86.exe
Windows cannot find 'C:\Windows\SysWOW64\winvnc86.exe'. Make sure you typed the name correctly, and then try again."

This started about a week ago, and I can't recall that I've done anything in that time to cause it.

Is there any way I can reinstall the SysWOW64\winvnc86.exe file that I'm missing? Or another way to fix this... other than attempting computer restore to before this started happening (which I will try if there aren't any other solutions)?

 

[cyclic]

It's part of a remote viewing\control program. If you didn't install it or don't want it go to the start menu and type MSCONFIG in the run line, when the app arrives go to the start up tab, remove the tick in the box next to the winvnc app, next time you boot it won't happen.

 

[ManicWolf]

Thanks for the advice, cyclic. I've just tried what you suggested but there isn't a winvnc app at all in the startup tab on msconfig.

 

[Kaktussoft]

Look here:
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
and programs listed therein will load automatically when you first log in to your user account. Next, the “All Users” Startup folder here:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
--------
Registry:
There are several places in the registry in which startup programs are specified. Installers add their programs to these keys for several reasons: to prevent tinkering, for more flexibility, or—in the case of viruses, Trojan horses, and spyware—to hide from plain view.
These keys contain startup programs for the current user (er, you):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

These keys contain startup programs for all users:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
And if you’re using 64-bit Windows, there also may be entries here:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
The naming of the keys should be self-explanatory. Programs referenced in either of the Run keys listed previously are run every time Windows starts, and are where you’ll find most of your startup programs. An entry referenced in one of the RunOnce keys is run only once and then removed from the key.
Other, less common places for startup programs to hide in your registry include:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\BootExecuteHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

 

[VistaKing]

Click here DDS

:ar: Click on Download Now button

:ar: When the download is complete . Drag the DDS program from the Downloads folder to your Desktop

:ar: Double click the DDS icon on the Desktop then click the Run button to run the tool.

:ar: Place a check next to attact.txt and click Start . When done, DDS will open two logs

• DDS.txt
• Attach.txt

:ar: Save two logs onto your desktop and upload them with your reply

 

[Faladu]

Quick search found:
WINVNC86.EXE is Trojan Btcmine

http://greatis.com/blog/how-to-remove-malware/winvnc86-exe.htm

See info on it? Sound about right OP?

Run Malwarebyte's Anti-malware lately, OP?

Try CCleaner from piriform.com and analyze the registry, I would fix any issues there related to the problem.

Sounds like you got rid of it, and the pointers that want to abuse it are still in place.

 

[VistaKing]

Run Farbar Recovery Scan Tool

64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .