My laptop is itself generating w64.exe files. Do I need to worry?

Question

I don't know why w64.exe files are getting generated in various location in my laptop. Quick Heal puts them in quarantine files. Are these files generated by Microsoft? How can I be sure regarding this? Or are these some sort of virus because I have been deleting such files since morning but they keep coming in different location.

Edit: After my conversation with @Gantendo virus-total is showing no virus but Quick Heal Paid Application shows it as a virus file.

Answer 1

From Python's Documentation for venv Module:

The venv module provides support for creating lightweight “virtual environments” with their own site directories, optionally isolated from system site directories

Now, further on the same site:

usage: venv [-h] [--system-site-packages] [--symlinks | --copies] [--clear][--upgrade] [--without-pip] [--prompt PROMPT] [--upgrade-deps] ENV_DIR [ENV_DIR ...]

Here, I wouldn't say I know exactly what's happening, but I see a certain pattern — Python's lib folder have been copied back and again to C:\users\jatin\venv and to folders having the name of the arguements like C:\users\jatin\[-h] etc. (As a matter of fact \Lib\site-packages\pip\_vendor\distlib does have a w64.exe and this is the only w64.exe in the python folder.)

Now, possibilities in order of decreasing probabilty are:

1. One of the OP's experiment with python created these wierd looking directories instead of creating a Virtualenv — Solution for this would be to simply delete those files created in C:\users\jatin
2. Python's programs got messed up — Solution for this would be to Reinstall python.
3. Some wierd malware is doing wierd things for wierd purposes: Scan your computer through. (As already said this is highly improbable.)

Although I would suggest you to start with a fresh installation of python and deleting those directories, just to make sure everything works like it should.

As for QuickHeal marking it as a malware, Many antiviruses sometimes mark python files as malwares. Also, the copied versions are still signed by microsoft. Long things short, there's no reason for you to worry.