Strange dll modifications

Learn about Computer Security Virus/Malware Removal Assistance
#1

Hello,

I have been a user for a long time and recently start seeing this strange activity. Whenever I run some program, comodo sometimes shows that the program is about to modify a dll. The popup then displays the same message that the application is about to modify the following dlls in the same sequence everytime.

cscui.dll
grooveextensions.dll is
msohevi.dll
and some lenovo dll

What could be wrong? I do software development and sometimes even newly created exe’s trigger the following sequence.

I keep my avira antivirus, windows defender, comodo firefall and defense plus upgraded and on all the time and haven’t encountered malware on this system yet.

Any help would be appreciated.

Thanks

#2

With a little help of Google:

http://www.prevx.com/filenames/X720949618725154401-X1/GROOVE.EXTENSIONS.DLL.html
http://www.programchecker.com/file/28425.aspx
http://www.prevx.com/filenames/X2408841975643082665-X1/LENOVO.DLL.html

Now check if the files you have are the regular files the above links suggest.

#3

These are false positives, or at least there is a bug in Windows where a certain component opens DLL files with more desired access than is needed (e.g. it requests write access even though it will never modify the DLL).

#4

Thanks for the help guys. I checked the file version and they are about the same. I am going to check some more using the tools in those websites and in the meantime I am disabling some components like groove. I don’t use it anyway.

I think they are false positives too but want to be sure.

Thanks again