1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

dllhost.exe

Discussion in 'Windows XP' started by WaIIy, Aug 6, 2010.

  1. WaIIy

    WaIIy Flightless Bird

    I don't recall installing anything new lately.

    All of a sudden, I have two instances of dllhost.exe running in Task
    Manager upon boot.

    If I kill them and their processes, there is no ill effect.

    Yes, I've scanned and also run Avira and Zone Alarm Pro.

    I'd like to get rid of them.
    Thanks
     
  2. PA Bear [MS MVP]

    PA Bear [MS MVP] Flightless Bird

    There is a very good chance that you are seeing the effects of a hijackware
    infection!

    NB: If you had no anti-virus application installed or the subscription had
    expired *when the machine first got infected* and/or your subscription has
    since expired and/or the machine's not been kept fully-patched at Windows
    Update, don't waste your time with any of the below: Format & reinstall
    Windows. A Repair Install will NOT help!

    Microsoft PCSafety provides home users (only) with no-charge support in
    dealing with malware infections such as viruses, spyware (including unwanted
    software), and adware.
    https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1

    Also available via the Consumer Security Support home page:
    https://consumersecuritysupport.microsoft.com/

    Otherwise...

    1. See if you can download/run the MSRT manually:
    http://www.microsoft.com/security/malwareremove/default.mspx

    NB: Run the FULL scan, not the QUICK scan! You may need to download the
    MSRT on a non-infected machine, then transfer MRT.EXE to the infected
    machine and rename it to SCAN.EXE before running it.

    2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
    in Safe Mode with Networking, if need be:
    http://onecare.live.com/site/en-us/center/howsafe.htm

    2b. Vista or Win7=> Run this scan instead:
    http://onecare.live.com/site/en-us/center/whatsnew.htm

    3. Now post the requested information (logs, etc.) in your own, new thread
    in one (only) of the following recommended forums for assistance by an
    expert in such matters. DO NOT SKIP THIS STEP!!

    . SpywareHammer: Malware Removal
    http://spywarehammer.com/simplemachinesforum/index.php?board=10.0

    . Spyware Warrior: Help with spyware removal
    http://www.spywarewarrior.com/viewforum.php?f=5,

    . DSL Reports: Security Cleanup
    http://www.dslreports.com/forum/cleanup

    . Bluetack: Malware Removal
    http://www.bluetack.co.uk/forums/index.php?showforum=172

    . AumHa: Malware Removal
    http://aumha.net/viewforum.php?f=30

    If these procedures look too complex - and there is no shame in admitting
    this isn't your cup of tea - take the machine to a local, reputable and
    independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

    WaIIy wrote:
    > I don't recall installing anything new lately.
    >
    > All of a sudden, I have two instances of dllhost.exe running in Task
    > Manager upon boot.
    >
    > If I kill them and their processes, there is no ill effect.
    >
    > Yes, I've scanned and also run Avira and Zone Alarm Pro.
    >
    > I'd like to get rid of them.
    > Thanks
     
  3. WaIIy

    WaIIy Flightless Bird

    On Fri, 6 Aug 2010 20:41:59 -0400, "PA Bear [MS MVP]"
    <PABearMVP@gmail.com> wrote:

    >There is a very good chance that you are seeing the effects of a hijackware
    >infection!
    >

    <snip>
    >
    >WaIIy wrote:
    >> I don't recall installing anything new lately.
    >>
    >> All of a sudden, I have two instances of dllhost.exe running in Task
    >> Manager upon boot.
    >>
    >> If I kill them and their processes, there is no ill effect.
    >>
    >> Yes, I've scanned and also run Avira and Zone Alarm Pro.
    >>
    >> I'd like to get rid of them.
    >> Thanks



    Thanks for the info, but I have no malware/infection.

    I just can't get rid of it on boot. If I kill the two instances in
    Task Manager, I'm fine.

    Also, I have very little loading on startup. I use Startup Control
    Panel to stop just about everything.
     
  4. PA Bear [MS MVP]

    PA Bear [MS MVP] Flightless Bird

    Then what's causing the two instances of DLLHOST.DLL to load at boot?

    WaIIy wrote:
    > On Fri, 6 Aug 2010 20:41:59 -0400, "PA Bear [MS MVP]"
    > <PABearMVP@gmail.com> wrote:
    >
    >> There is a very good chance that you are seeing the effects of a
    >> hijackware
    >> infection!
    >>

    > <snip>
    >>
    >> WaIIy wrote:
    >>> I don't recall installing anything new lately.
    >>>
    >>> All of a sudden, I have two instances of dllhost.exe running in Task
    >>> Manager upon boot.
    >>>
    >>> If I kill them and their processes, there is no ill effect.
    >>>
    >>> Yes, I've scanned and also run Avira and Zone Alarm Pro.
    >>>
    >>> I'd like to get rid of them.
    >>> Thanks

    >
    >
    > Thanks for the info, but I have no malware/infection.
    >
    > I just can't get rid of it on boot. If I kill the two instances in
    > Task Manager, I'm fine.
    >
    > Also, I have very little loading on startup. I use Startup Control
    > Panel to stop just about everything.
     
  5. Peter Foldes

    Peter Foldes Flightless Bird

    Wally

    A quick question. How do you know you do not have a malware/infection.


    --
    Peter

    Please Reply to Newsgroup for the benefit of others
    Requests for assistance by email can not and will not be acknowledged.
    http://www.microsoft.com/protect

    "WaIIy" <WaIIy@(nft).invalid> wrote in message
    news:pqgp56dm1i1nt2k9otbs96fao0579k5nj0@4ax.com...
    > On Fri, 6 Aug 2010 20:41:59 -0400, "PA Bear [MS MVP]"
    > <PABearMVP@gmail.com> wrote:
    >
    >>There is a very good chance that you are seeing the effects of a hijackware
    >>infection!
    >>

    > <snip>
    >>
    >>WaIIy wrote:
    >>> I don't recall installing anything new lately.
    >>>
    >>> All of a sudden, I have two instances of dllhost.exe running in Task
    >>> Manager upon boot.
    >>>
    >>> If I kill them and their processes, there is no ill effect.
    >>>
    >>> Yes, I've scanned and also run Avira and Zone Alarm Pro.
    >>>
    >>> I'd like to get rid of them.
    >>> Thanks

    >
    >
    > Thanks for the info, but I have no malware/infection.
    >
    > I just can't get rid of it on boot. If I kill the two instances in
    > Task Manager, I'm fine.
    >
    > Also, I have very little loading on startup. I use Startup Control
    > Panel to stop just about everything.
     
  6. PA Bear [MS MVP]

    PA Bear [MS MVP] Flightless Bird

    +1

    Peter Foldes wrote:
    > Wally
    >
    > A quick question. How do you know you do not have a malware/infection.
    >
    > "WaIIy" <WaIIy@(nft).invalid> wrote in message
    >>
    >>> There is a very good chance that you are seeing the effects of a
    >>> hijackware infection!
    >>>

    >> <snip>
    >> Thanks for the info, but I have no malware/infection.
    >>
    >> I just can't get rid of it on boot. If I kill the two instances in
    >> Task Manager, I'm fine.
    >>
    >> Also, I have very little loading on startup. I use Startup Control
    >> Panel to stop just about everything.
     
  7. WaIIy

    WaIIy Flightless Bird

    On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com>
    wrote:

    >Wally
    >
    >A quick question. How do you know you do not have a malware/infection.


    Hi Peter,

    Well, everything runs perfectly. I use Firefox and have every stopper
    addon known to man. I run CCleaner twice a day.
    Ran Avira and Malwarebytes.

    I can stop the instances in Task manager with no known adverse effect.

    I use Zone Alarm Pro and I have no unusual outbound requests I can see
    using Process Explorer.

    I have winxp pro no network, dsl and I'm behind a router.

    Google comes up with the same issue, but no real way to stop it.

    I haven't installed any new software except an Aimp2 update.

    I might have installed a Java and Flash update and I suspect one of
    those. I don't load Java on boot and goto the online Flash manager and
    kabosh everything.

    I don't know for sure I have a malware/infection problem, but highly
    doubt it.

    Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the
    registry. Well, maybe I don't know.
     
  8. PA Bear [MS MVP]

    PA Bear [MS MVP] Flightless Bird

    So what's causing the two instances of DLLHOST.EXE to load at boot?


    WaIIy wrote:
    > On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com>
    > wrote:
    >
    >> Wally
    >>
    >> A quick question. How do you know you do not have a malware/infection.

    >
    > Hi Peter,
    >
    > Well, everything runs perfectly. I use Firefox and have every stopper
    > addon known to man. I run CCleaner twice a day.
    > Ran Avira and Malwarebytes.
    >
    > I can stop the instances in Task manager with no known adverse effect.
    >
    > I use Zone Alarm Pro and I have no unusual outbound requests I can see
    > using Process Explorer.
    >
    > I have winxp pro no network, dsl and I'm behind a router.
    >
    > Google comes up with the same issue, but no real way to stop it.
    >
    > I haven't installed any new software except an Aimp2 update.
    >
    > I might have installed a Java and Flash update and I suspect one of
    > those. I don't load Java on boot and goto the online Flash manager and
    > kabosh everything.
    >
    > I don't know for sure I have a malware/infection problem, but highly
    > doubt it.
    >
    > Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the
    > registry. Well, maybe I don't know.
     
  9. WaIIy

    WaIIy Flightless Bird

    That's what I'd like to know. If I find out, I'll let you know.


    On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]"
    <PABearMVP@gmail.com> wrote:

    >So what's causing the two instances of DLLHOST.EXE to load at boot?
    >
    >
    >WaIIy wrote:
    >> On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com>
    >> wrote:
    >>
    >>> Wally
    >>>
    >>> A quick question. How do you know you do not have a malware/infection.

    >>
    >> Hi Peter,
    >>
    >> Well, everything runs perfectly. I use Firefox and have every stopper
    >> addon known to man. I run CCleaner twice a day.
    >> Ran Avira and Malwarebytes.
    >>
    >> I can stop the instances in Task manager with no known adverse effect.
    >>
    >> I use Zone Alarm Pro and I have no unusual outbound requests I can see
    >> using Process Explorer.
    >>
    >> I have winxp pro no network, dsl and I'm behind a router.
    >>
    >> Google comes up with the same issue, but no real way to stop it.
    >>
    >> I haven't installed any new software except an Aimp2 update.
    >>
    >> I might have installed a Java and Flash update and I suspect one of
    >> those. I don't load Java on boot and goto the online Flash manager and
    >> kabosh everything.
    >>
    >> I don't know for sure I have a malware/infection problem, but highly
    >> doubt it.
    >>
    >> Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the
    >> registry. Well, maybe I don't know.
     
  10. WaIIy

    WaIIy Flightless Bird

    I haven't quite nailed it down, but I think it has to do with Java.

    I uninstalled Java and the two dllhost.exe don't show in Task manager
    upon boot.

    I'll keep you posted if you'd like.



    On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]"
    <PABearMVP@gmail.com> wrote:

    >So what's causing the two instances of DLLHOST.EXE to load at boot?
    >
    >
    >WaIIy wrote:
    >> On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com>
    >> wrote:
    >>
    >>> Wally
    >>>
    >>> A quick question. How do you know you do not have a malware/infection.

    >>
    >> Hi Peter,
    >>
    >> Well, everything runs perfectly. I use Firefox and have every stopper
    >> addon known to man. I run CCleaner twice a day.
    >> Ran Avira and Malwarebytes.
    >>
    >> I can stop the instances in Task manager with no known adverse effect.
    >>
    >> I use Zone Alarm Pro and I have no unusual outbound requests I can see
    >> using Process Explorer.
    >>
    >> I have winxp pro no network, dsl and I'm behind a router.
    >>
    >> Google comes up with the same issue, but no real way to stop it.
    >>
    >> I haven't installed any new software except an Aimp2 update.
    >>
    >> I might have installed a Java and Flash update and I suspect one of
    >> those. I don't load Java on boot and goto the online Flash manager and
    >> kabosh everything.
    >>
    >> I don't know for sure I have a malware/infection problem, but highly
    >> doubt it.
    >>
    >> Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the
    >> registry. Well, maybe I don't know.
     
  11. thecreator

    thecreator Flightless Bird

    Hi Wally,

    Go to Start then Search and Enter dllhost.

    Search the Local Hard Drive and all Hidden Files and Folders. Take a
    look at the Date of the file.

    You should have a File Creation Date of 8/4/2004 with the mouse hovering
    over the name. Date Modified is the Date it was installed on the computer.


    --
    thecreator




    "WaIIy" <WaIIy@(nft).invalid> wrote in message
    news:eek:69p56t063dtn0htun0h9d76tevn1vfd21@4ax.com...
    >
    > I don't recall installing anything new lately.
    >
    > All of a sudden, I have two instances of dllhost.exe running in Task
    > Manager upon boot.
    >
    > If I kill them and their processes, there is no ill effect.
    >
    > Yes, I've scanned and also run Avira and Zone Alarm Pro.
    >
    > I'd like to get rid of them.
    > Thanks
     
  12. Daave

    Daave Flightless Bird

  13. Mike S

    Mike S Flightless Bird

    On 8/7/2010 6:32 PM, WaIIy wrote:
    >
    > I haven't quite nailed it down, but I think it has to do with Java.
    >
    > I uninstalled Java and the two dllhost.exe don't show in Task manager
    > upon boot.
    >
    > I'll keep you posted if you'd like.
    >
    >
    >
    > On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]"
    > <PABearMVP@gmail.com> wrote:
    >
    >> So what's causing the two instances of DLLHOST.EXE to load at boot?

    <snip>

    Would pocess explorer help with this?

    http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

    Ever wondered which program has a particular file or directory open? Now
    you can find out. Process Explorer shows you information about which
    handles and DLLs processes have opened or loaded.

    The Process Explorer display consists of two sub-windows. The top window
    always shows a list of the currently active processes, including the
    names of their owning accounts, whereas the information displayed in the
    bottom window depends on the mode that Process Explorer is in: if it is
    in handle mode you'll see the handles that the process selected in the
    top window has opened; if Process Explorer is in DLL mode you'll see the
    DLLs and memory-mapped files that the process has loaded. Process
    Explorer also has a powerful search capability that will quickly show
    you which processes have particular handles opened or DLLs loaded.

    The unique capabilities of Process Explorer make it useful for tracking
    down DLL-version problems or handle leaks, and provide insight into the
    way Windows and applications work
     
  14. WaIIy

    WaIIy Flightless Bird

    On Sat, 07 Aug 2010 18:44:20 -0700, Mike S <mscir@yahoo.com> wrote:

    >On 8/7/2010 6:32 PM, WaIIy wrote:
    >>
    >> I haven't quite nailed it down, but I think it has to do with Java.
    >>
    >> I uninstalled Java and the two dllhost.exe don't show in Task manager
    >> upon boot.
    >>
    >> I'll keep you posted if you'd like.
    >>
    >>
    >>
    >> On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]"
    >> <PABearMVP@gmail.com> wrote:
    >>
    >>> So what's causing the two instances of DLLHOST.EXE to load at boot?

    ><snip>
    >
    >Would pocess explorer help with this?
    >
    >http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
    >


    I looked with PE. I could see the two dllhost.exe , but couldn't make
    sense of what they were connected to.
     
  15. WaIIy

    WaIIy Flightless Bird

    Yup, Aug 4, 2004 for dllhost.exe

    Anyway, I solved it.

    I opened Revo Uninstaller and noticed I had two different Java updates
    in there. ( damn things showed 90 megs)

    I uninstalled all Java.

    I found the firefox Java dll in Firefox and deleted it.

    Reboot

    I installed newest Java

    (The new one shows 90.95 megs but no way I downloaded 90 megs, must be
    some kind of error)

    Went to Java icon in Control Panel set - no auto update - no
    quickstart-no cache

    Java works fine in Firefox.

    No dllhost.exe in Task Manager

    Reboot

    No dllhost.exe in Task Manager

    Odd thing, eh?


    On Sat, 7 Aug 2010 21:32:57 -0400, "thecreator" <thecreator@home.com>
    wrote:

    >Hi Wally,
    >
    > Go to Start then Search and Enter dllhost.
    >
    > Search the Local Hard Drive and all Hidden Files and Folders. Take a
    >look at the Date of the file.
    >
    > You should have a File Creation Date of 8/4/2004 with the mouse hovering
    >over the name. Date Modified is the Date it was installed on the computer.
     
  16. WaIIy

    WaIIy Flightless Bird

    Thanks

    I looked at that before and don't have that registry key. I disabled
    half of my Services and that didn't do me any good.


    On Sat, 7 Aug 2010 21:40:44 -0400, "Daave" <daave@example.com> wrote:

    >See:
    >
    >http://searchtasks.answersthatwork.com/tasklist.php?File=DLLHost
    >
    >WaIIy wrote:
    >> I haven't quite nailed it down, but I think it has to do with Java.
    >>
    >> I uninstalled Java and the two dllhost.exe don't show in Task manager
    >> upon boot.
    >>
    >> I'll keep you posted if you'd like.

    >
     
  17. Mike S

    Mike S Flightless Bird

    On 8/7/2010 6:46 PM, WaIIy wrote:
    > On Sat, 07 Aug 2010 18:44:20 -0700, Mike S<mscir@yahoo.com> wrote:
    >
    >> On 8/7/2010 6:32 PM, WaIIy wrote:
    >>>
    >>> I haven't quite nailed it down, but I think it has to do with Java.
    >>>
    >>> I uninstalled Java and the two dllhost.exe don't show in Task manager
    >>> upon boot.
    >>>
    >>> I'll keep you posted if you'd like.
    >>>
    >>>
    >>>
    >>> On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]"
    >>> <PABearMVP@gmail.com> wrote:
    >>>
    >>>> So what's causing the two instances of DLLHOST.EXE to load at boot?

    >> <snip>
    >>
    >> Would pocess explorer help with this?
    >>
    >> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
    >>

    >
    > I looked with PE. I could see the two dllhost.exe , but couldn't make
    > sense of what they were connected to.


    post the results if you'd like more folks to look at them.
     
  18. Mike S

    Mike S Flightless Bird

    On 8/7/2010 6:46 PM, WaIIy wrote:
    > On Sat, 07 Aug 2010 18:44:20 -0700, Mike S<mscir@yahoo.com> wrote:
    >
    >> On 8/7/2010 6:32 PM, WaIIy wrote:
    >>>
    >>> I haven't quite nailed it down, but I think it has to do with Java.
    >>>
    >>> I uninstalled Java and the two dllhost.exe don't show in Task manager
    >>> upon boot.
    >>>
    >>> I'll keep you posted if you'd like.
    >>>
    >>>
    >>>
    >>> On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]"
    >>> <PABearMVP@gmail.com> wrote:
    >>>
    >>>> So what's causing the two instances of DLLHOST.EXE to load at boot?

    >> <snip>
    >>
    >> Would pocess explorer help with this?
    >>
    >> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
    >>

    >
    > I looked with PE. I could see the two dllhost.exe , but couldn't make
    > sense of what they were connected to.


    How about giving Process Monitor a try?

    http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

    Process Monitor is an advanced monitoring tool for Windows that shows
    real-time file system, Registry and process/thread activity. It combines
    the features of two legacy Sysinternals utilities, Filemon and Regmon,
    and adds an extensive list of enhancements including rich and
    non-destructive filtering, comprehensive event properties such session
    IDs and user names, reliable process information, full thread stacks
    with integrated symbol support for each operation, simultaneous logging
    to a file, and much more. Its uniquely powerful features will make
    Process Monitor a core utility in your system troubleshooting and
    malware hunting toolkit.
     

Share This Page