Recommended Free Tools
A wr64.sys warning does not, by itself, prove that your PC has a particular virus. In the documented Windows 10 case, Avast blocked a vulnerable driver at C:Program FilesgooglelibsWR64.sys, while Malwarebytes reported an outbound HTTPS connection attributed to C:Windowsexplorer.exe. Investigators also found a suspicious scheduled task launching an unsigned secureboot.exe. The machine was cleaned, and a later ESET Online Scanner run reported zero detections, but that result applies to that computer—not every file with the same name.
What happened in the original case?
A BleepingComputer support topic opened on September 18, 2023, after a Windows 10 user received an Avast One warning that WR64.sys had been blocked because of vulnerabilities. Malwarebytes also displayed an outbound connection alert:
As an Amazon Associate I earn from qualifying purchases.
| Alert detail | Value reported in the topic |
|---|---|
| Process | C:Windowsexplorer.exe |
| Remote address | 193.105.135.135:443 |
| Direction | Outbound |
| Driver path | C:Program FilesgooglelibsWR64.sys |
The responder removed the driver, deleted a suspicious scheduled task, removed a Firefox policy, reset networking and Windows Firewall, and repaired Windows files. The topic closed September 22, 2023. ESET later reported 541,094 files scanned, zero detected and zero cleaned. That is encouraging evidence that the reported symptoms were resolved, not proof of perfect security or a universal diagnosis.
Source: the original BleepingComputer topic.
Is wr64.sys definitely malware?
No. A .sys file is normally a Windows driver or another kernel-level component. The filename is not a malware-family name, and the original topic did not establish a hash, signer, family identification or sandbox verdict. Avast described a blocked vulnerable driver, which can mean unsafe, outdated, unsigned or abuse-prone code without identifying a specific infection.
#1 Best Overall
The directory C:Program Filesgooglelibs is unusual enough to investigate, but it does not prove that the file is fake or that it belongs to Google. Do not download a replacement from an unofficial driver site, and do not delete a driver solely because its name looks suspicious.
Verify the file before taking action
- Record the path, size and timestamps:
Get-Item "C:Program FilesgooglelibsWR64.sys" | Format-List FullName,Length,CreationTime,LastWriteTime,VersionInfo - In File Explorer, right-click the file, choose Properties, and inspect Digital Signatures. An unexpected or invalid signer raises concern but is not conclusive alone.
- Calculate a SHA-256 hash for comparison with a trusted vendor or incident-response source:
Get-FileHash "C:Program FilesgooglelibsWR64.sys" -Algorithm SHA256 - Determine whether a service or driver entry loads it, whether it reappears after reboot, and which installer or application created it.
A recently created unsigned file loaded by an unexplained service is substantially more suspicious than a signed driver installed with known hardware or security software. Preserve the file and logs if the computer belongs to an employer or if fraud, stalking or data theft is possible.
Why did Malwarebytes mention explorer.exe?
An alert naming a process means that the product associated the network activity with that process. It does not automatically mean that Windows Explorer was replaced.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThree possibilities
- The genuine shell at
C:Windowsexplorer.exeinitiated or inherited a connection after a malicious URL, file or extension caused it. - A malicious executable is impersonating Explorer from another directory.
- The security product attributed the connection to the process that opened it, while another component caused the activity.
Check the path and signature:
Get-AuthenticodeSignature "$env:WINDIRexplorer.exe"
Get-FileHash "$env:WINDIRexplorer.exe" -Algorithm SHA256Also check whether the connection continues after reboot and after suspicious startup entries, extensions, services and tasks are disabled. The recorded IP address is evidence of an alert, not independent proof that the address was malicious or that Explorer itself was compromised.
Immediate precautions when compromise is plausible
- Disconnect Wi-Fi or unplug Ethernet if the computer is actively making unexplained connections. Keep it powered on only when needed to preserve evidence.
- Do not sign in to banking, email, cloud storage or a password manager on the affected PC.
- Using a known-clean device, change important passwords, revoke active sessions and enable multifactor authentication. Prioritize email, financial, administrator and password-manager accounts.
- Back up personal documents and photographs. Avoid copying executables, scripts, browser profiles, extensions or suspicious archives until they have been checked.
- If the incident may involve work, regulated data, financial loss or harassment, preserve alerts and contact your administrator or an incident-response professional.
Create a restore point only if Windows is stable; System Restore is not a guaranteed malware-removal method.
Safe Windows scanning sequence
1. Update security intelligence and Windows
Open Windows Security > Virus & threat protection > Protection updates, install the latest intelligence update, then run Windows Update. Security interfaces can vary slightly between Windows 10 and Windows 11.
2. Run a Microsoft Defender Full scan
Go to Windows Security > Virus & threat protection > Scan options > Full scan > Scan now. Microsoft recommends a full scan when infection is suspected because it examines every file and program, unlike a quick scan. See Microsoft’s antivirus FAQ.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →3. Run Microsoft Defender Offline
Choose Windows Security > Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan) > Scan now. Save work first: Windows restarts and scans outside the normal environment, making it harder for persistent malware to hide. Results appear afterward in Protection history. If BitLocker is enabled, have the recovery key available; Microsoft documents this consideration at the Defender Offline guidance.
4. Use one reputable second opinion
Use one on-demand scanner if the alert persists or you need confirmation. The original case used Malwarebytes, ESET Online Scanner, HitmanPro and AdwCleaner during diagnosis; installing all of them as permanent real-time protection is unnecessary. Microsoft Safety Scanner is an official manually launched option, but each download expires after 10 days: download guidance.
Inspect persistence instead of deleting files blindly
The strongest finding in the original topic was not the filename alone. A task named System32Taskspowershellsecureboot launched:
C:Program FilesWindowsPowerShellModulesSecureBootsecureboot.exeThe responder identified that executable as unsigned. A Firefox policy restriction and a Global Games Network directory were additional indicators requiring review.
Review scheduled tasks
Get-ScheduledTask |
Where-Object {$_.TaskName -match 'secureboot|powershell|update|driver'} |
Select-Object TaskName,TaskPath,StateInspect a task’s action before disabling or removing it:
(Get-ScheduledTask -TaskName "powershellsecureboot").ActionsVerify the executable’s signer, path, parent installer and purpose. A task called “update” is not automatically malicious, and deleting a legitimate vendor task can break software. Review services, startup entries, browser extensions and policies using the same evidence-first approach.
Why you must not copy a forum FRST fix
Farbar Recovery Scan Tool (FRST) fixlists can delete files, services, tasks, registry values and policies. The responder explicitly wrote the original script for that one machine. Running it on another computer can remove legitimate components or make Windows unbootable. Use FRST only when a trained responder has reviewed logs from your exact system and supplied a machine-specific fix.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Repair commands: useful, but not malware removal
These commands were used in the case as network and Windows-integrity repairs:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
netsh winsock reset catalog
netsh int ip reset C:resettcpip.txt
netsh advfirewall reset
netsh advfirewall set allprofiles state ON
bitsadmin /Reset /Allusers
ipconfig /flushdns
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealthnetsh advfirewall resetremoves custom firewall rules. Record VPN, server, development, game and enterprise rules first.sfc /scannowrepairs protected Windows files; it does not remove every third-party persistence mechanism.- DISM repairs the Windows component store and may require Windows Update or installation media.
bitsadminis legacy and is not a general malware-removal tool.
The responder reported that SFC repaired corrupt files. That shows Windows corruption, not that malware damaged those files.
Best Value
Quarantine, extra tools and real-time protection
Quarantine normally isolates a detection so it cannot run. Do not restore an item merely because an application behaves oddly, and never execute files from a quarantine folder. Keep quarantine temporarily if you need evidence or want to submit a false-positive report; delete it after the system is stable and evidence is no longer needed. Antivirus uninstallers may remove their quarantine database.
Keep one real-time antivirus—Microsoft Defender or one reputable third-party suite. Use additional scanners on demand only when there is a reason. Microsoft advises against running multiple simultaneous real-time antivirus products because of conflicts and performance problems: Microsoft’s provider guidance and FAQ.
When a clean reinstall is safer
Stop repeating scans and consider a clean Windows reinstall or professional response when:
- Detections return after Defender Offline and a second-opinion scan.
- Security tools are disabled or prevented from updating.
- Unknown administrator accounts, drivers, services, tasks or browser policies remain.
- Credentials or financial information may have been exposed.
- The computer is used for business, healthcare, legal, financial or privileged administration.
- You cannot establish what was changed, or rootkit or bootkit activity is suspected.
Back up personal files first, scan the backup from a clean system, and reinstall from official Microsoft media. Microsoft explains that reset or reinstall may be necessary after irreversible malware changes at its malware-removal troubleshooting page.
Prevent a recurrence
- Install Windows, browser and application updates promptly.
- Download drivers and software from the manufacturer or Microsoft, not unofficial driver sites.
- Remove unused browser extensions and reject unexpected enterprise policies.
- Avoid pirated software and “activators,” common sources of kernel drivers and persistence.
- Maintain offline or versioned backups and test restoring them.
- Use unique passwords and multifactor authentication.
High fan speed is a symptom, not a diagnosis: scans, Windows servicing, browser activity and thermal problems can all cause it. Likewise, a clean ESET result is reassuring but cannot prove that no compromise ever occurred.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
