c:\windows\temp\cpuz136\cpuz136_x64.sys what is it?

This may or may not be related to this but we've had two random reboots of our Hyper-V servers which was of great concern. In diagnosing the event logs we discovered that cpuz136_x64.sys was being installed every day across a lot of our servers.

At first we thought we'd got a Trojan but further investigation revealed that the event log entries started on the same day the corporate version of Snow was rolled out.

Snow is a commercial software licensing tracking & compliance tool (it's very good) but we weren't aware that it carried out hardware scans. It contains the CPU-Z SDK:

"C:\Program Files\INVENTORYCLIENT\cpuidsdk64.dll"

So I wonder if the original poster is part of a corporate environment where Snow is used?

Snow has lots of configuration entries in it's INI file and one setting is to disable hardware scans.

I had the same issue now on Windows 10.  

File cpuz140_x64.sys showed up in folder of the same name in my user temp directory .  It looks like it was associated with an Intel utility I had downloaded to check my Intel hardware drivers.  

Anyhoo ... I was able to rid myself of this program by running Autoruns (sysinternal), search for cpuz and unchecking the program running out of control set services (although I couldn't see a service from services so it must be hidden).  

I had previously removed the intel utility but it didn't remove this.   No impact from unchecking and rebooting. 

Just sharing the knowledge on a simple solution to remove it.  Once the service is stopped the temp folder disappears.

Hi,

cpuz136_x64.sys is a driver for CPU-z, a very popular HWM/Benchmark software: http://www.cpuid.com/softwares/cpu-z.html

With this said, CPU-z likely tried to add itself to the start up list, so it could run on start up. If you cannot find CPU-z in your programs & features list, do the following:

1. Navigate to that file path and delete the .sys file, or rename it to .old (I'd recommend the latter). Given it's in temp it'll delete itself short anyway, however, it may be worth doing.

2. Run Malwarebytes just in case this isn't malware disguised as a legitimate file - http://www.malwarebytes.org/mwb-download/

Be sure to un check free 14 day pro trial during install.

Regards,

Patrick

Thanks Patrick.

I couldn't find it's location anywhere on my pc. The only time I ever saw it is when it would request a start-up placement. I denied it because of this and the fact that it is in a temp location.

Since it had only began doing this today, I restored my system to a few days ago... That seemed to clear the problem, I thought. My OS boots to desktop, not Win8 App page. When I pressed the little 'Windows' button on my keyboard, to go to the app page, I was surprised.

The entire interface had reverted to it's original (stock) layout. All the tiles I had arranged were removed. It's quite odd in that none of the apps were deleted/uninstalled/disabled. They were all still with proper settings, they had just been removed from their place on the app tile page.

So far everything else seems perfectly fine and the cpuz request for start-up permission has vanished.

Just to clarify, I did nothing to my system other than running malwarebytes, then restoring to a couple of days ago.

I feel a little better about it, but I also have that feeling in the back of my mind that this issue is still lurking and may pop it's head up at some point.

If it's the result of a malicious infection, hopefully any new security definitions will catch it for me.

Also...

I read some things about CPU z and found information about it on the cpuid site, but it puzzled me and led to my decision to do a restore.

Unless CPU z came pre-installed on my laptop (Gateway NE72215U) it shouldn't be there, because I didn't install it.

Could it get on my pc without a download/installation? My opinion is that it couldn't, hence restore.

Thanks again Patrick!