I don't recall installing anything new lately. All of a sudden, I have two instances of dllhost.exe running in Task Manager upon boot. If I kill them and their processes, there is no ill effect. Yes, I've scanned and also run Avira and Zone Alarm Pro. I'd like to get rid of them. Thanks
There is a very good chance that you are seeing the effects of a hijackware infection! NB: If you had no anti-virus application installed or the subscription had expired *when the machine first got infected* and/or your subscription has since expired and/or the machine's not been kept fully-patched at Windows Update, don't waste your time with any of the below: Format & reinstall Windows. A Repair Install will NOT help! Microsoft PCSafety provides home users (only) with no-charge support in dealing with malware infections such as viruses, spyware (including unwanted software), and adware. https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1 Also available via the Consumer Security Support home page: https://consumersecuritysupport.microsoft.com/ Otherwise... 1. See if you can download/run the MSRT manually: http://www.microsoft.com/security/malwareremove/default.mspx NB: Run the FULL scan, not the QUICK scan! You may need to download the MSRT on a non-infected machine, then transfer MRT.EXE to the infected machine and rename it to SCAN.EXE before running it. 2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!) in Safe Mode with Networking, if need be: http://onecare.live.com/site/en-us/center/howsafe.htm 2b. Vista or Win7=> Run this scan instead: http://onecare.live.com/site/en-us/center/whatsnew.htm 3. Now post the requested information (logs, etc.) in your own, new thread in one (only) of the following recommended forums for assistance by an expert in such matters. DO NOT SKIP THIS STEP!! . SpywareHammer: Malware Removal http://spywarehammer.com/simplemachinesforum/index.php?board=10.0 . Spyware Warrior: Help with spyware removal http://www.spywarewarrior.com/viewforum.php?f=5, . DSL Reports: Security Cleanup http://www.dslreports.com/forum/cleanup . Bluetack: Malware Removal http://www.bluetack.co.uk/forums/index.php?showforum=172 . AumHa: Malware Removal http://aumha.net/viewforum.php?f=30 If these procedures look too complex - and there is no shame in admitting this isn't your cup of tea - take the machine to a local, reputable and independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop. WaIIy wrote: > I don't recall installing anything new lately. > > All of a sudden, I have two instances of dllhost.exe running in Task > Manager upon boot. > > If I kill them and their processes, there is no ill effect. > > Yes, I've scanned and also run Avira and Zone Alarm Pro. > > I'd like to get rid of them. > Thanks
On Fri, 6 Aug 2010 20:41:59 -0400, "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote: >There is a very good chance that you are seeing the effects of a hijackware >infection! > <snip> > >WaIIy wrote: >> I don't recall installing anything new lately. >> >> All of a sudden, I have two instances of dllhost.exe running in Task >> Manager upon boot. >> >> If I kill them and their processes, there is no ill effect. >> >> Yes, I've scanned and also run Avira and Zone Alarm Pro. >> >> I'd like to get rid of them. >> Thanks Thanks for the info, but I have no malware/infection. I just can't get rid of it on boot. If I kill the two instances in Task Manager, I'm fine. Also, I have very little loading on startup. I use Startup Control Panel to stop just about everything.
Then what's causing the two instances of DLLHOST.DLL to load at boot? WaIIy wrote: > On Fri, 6 Aug 2010 20:41:59 -0400, "PA Bear [MS MVP]" > <PABearMVP@gmail.com> wrote: > >> There is a very good chance that you are seeing the effects of a >> hijackware >> infection! >> > <snip> >> >> WaIIy wrote: >>> I don't recall installing anything new lately. >>> >>> All of a sudden, I have two instances of dllhost.exe running in Task >>> Manager upon boot. >>> >>> If I kill them and their processes, there is no ill effect. >>> >>> Yes, I've scanned and also run Avira and Zone Alarm Pro. >>> >>> I'd like to get rid of them. >>> Thanks > > > Thanks for the info, but I have no malware/infection. > > I just can't get rid of it on boot. If I kill the two instances in > Task Manager, I'm fine. > > Also, I have very little loading on startup. I use Startup Control > Panel to stop just about everything.
Wally A quick question. How do you know you do not have a malware/infection. -- Peter Please Reply to Newsgroup for the benefit of others Requests for assistance by email can not and will not be acknowledged. http://www.microsoft.com/protect "WaIIy" <WaIIy@(nft).invalid> wrote in message newsqgp56dm1i1nt2k9otbs96fao0579k5nj0@4ax.com... > On Fri, 6 Aug 2010 20:41:59 -0400, "PA Bear [MS MVP]" > <PABearMVP@gmail.com> wrote: > >>There is a very good chance that you are seeing the effects of a hijackware >>infection! >> > <snip> >> >>WaIIy wrote: >>> I don't recall installing anything new lately. >>> >>> All of a sudden, I have two instances of dllhost.exe running in Task >>> Manager upon boot. >>> >>> If I kill them and their processes, there is no ill effect. >>> >>> Yes, I've scanned and also run Avira and Zone Alarm Pro. >>> >>> I'd like to get rid of them. >>> Thanks > > > Thanks for the info, but I have no malware/infection. > > I just can't get rid of it on boot. If I kill the two instances in > Task Manager, I'm fine. > > Also, I have very little loading on startup. I use Startup Control > Panel to stop just about everything.
+1 Peter Foldes wrote: > Wally > > A quick question. How do you know you do not have a malware/infection. > > "WaIIy" <WaIIy@(nft).invalid> wrote in message >> >>> There is a very good chance that you are seeing the effects of a >>> hijackware infection! >>> >> <snip> >> Thanks for the info, but I have no malware/infection. >> >> I just can't get rid of it on boot. If I kill the two instances in >> Task Manager, I'm fine. >> >> Also, I have very little loading on startup. I use Startup Control >> Panel to stop just about everything.
On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com> wrote: >Wally > >A quick question. How do you know you do not have a malware/infection. Hi Peter, Well, everything runs perfectly. I use Firefox and have every stopper addon known to man. I run CCleaner twice a day. Ran Avira and Malwarebytes. I can stop the instances in Task manager with no known adverse effect. I use Zone Alarm Pro and I have no unusual outbound requests I can see using Process Explorer. I have winxp pro no network, dsl and I'm behind a router. Google comes up with the same issue, but no real way to stop it. I haven't installed any new software except an Aimp2 update. I might have installed a Java and Flash update and I suspect one of those. I don't load Java on boot and goto the online Flash manager and kabosh everything. I don't know for sure I have a malware/infection problem, but highly doubt it. Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the registry. Well, maybe I don't know.
So what's causing the two instances of DLLHOST.EXE to load at boot? WaIIy wrote: > On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com> > wrote: > >> Wally >> >> A quick question. How do you know you do not have a malware/infection. > > Hi Peter, > > Well, everything runs perfectly. I use Firefox and have every stopper > addon known to man. I run CCleaner twice a day. > Ran Avira and Malwarebytes. > > I can stop the instances in Task manager with no known adverse effect. > > I use Zone Alarm Pro and I have no unusual outbound requests I can see > using Process Explorer. > > I have winxp pro no network, dsl and I'm behind a router. > > Google comes up with the same issue, but no real way to stop it. > > I haven't installed any new software except an Aimp2 update. > > I might have installed a Java and Flash update and I suspect one of > those. I don't load Java on boot and goto the online Flash manager and > kabosh everything. > > I don't know for sure I have a malware/infection problem, but highly > doubt it. > > Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the > registry. Well, maybe I don't know.
That's what I'd like to know. If I find out, I'll let you know. On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote: >So what's causing the two instances of DLLHOST.EXE to load at boot? > > >WaIIy wrote: >> On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com> >> wrote: >> >>> Wally >>> >>> A quick question. How do you know you do not have a malware/infection. >> >> Hi Peter, >> >> Well, everything runs perfectly. I use Firefox and have every stopper >> addon known to man. I run CCleaner twice a day. >> Ran Avira and Malwarebytes. >> >> I can stop the instances in Task manager with no known adverse effect. >> >> I use Zone Alarm Pro and I have no unusual outbound requests I can see >> using Process Explorer. >> >> I have winxp pro no network, dsl and I'm behind a router. >> >> Google comes up with the same issue, but no real way to stop it. >> >> I haven't installed any new software except an Aimp2 update. >> >> I might have installed a Java and Flash update and I suspect one of >> those. I don't load Java on boot and goto the online Flash manager and >> kabosh everything. >> >> I don't know for sure I have a malware/infection problem, but highly >> doubt it. >> >> Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the >> registry. Well, maybe I don't know.
I haven't quite nailed it down, but I think it has to do with Java. I uninstalled Java and the two dllhost.exe don't show in Task manager upon boot. I'll keep you posted if you'd like. On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote: >So what's causing the two instances of DLLHOST.EXE to load at boot? > > >WaIIy wrote: >> On Sat, 7 Aug 2010 09:27:28 -0400, "Peter Foldes" <okf22@hotmail.com> >> wrote: >> >>> Wally >>> >>> A quick question. How do you know you do not have a malware/infection. >> >> Hi Peter, >> >> Well, everything runs perfectly. I use Firefox and have every stopper >> addon known to man. I run CCleaner twice a day. >> Ran Avira and Malwarebytes. >> >> I can stop the instances in Task manager with no known adverse effect. >> >> I use Zone Alarm Pro and I have no unusual outbound requests I can see >> using Process Explorer. >> >> I have winxp pro no network, dsl and I'm behind a router. >> >> Google comes up with the same issue, but no real way to stop it. >> >> I haven't installed any new software except an Aimp2 update. >> >> I might have installed a Java and Flash update and I suspect one of >> those. I don't load Java on boot and goto the online Flash manager and >> kabosh everything. >> >> I don't know for sure I have a malware/infection problem, but highly >> doubt it. >> >> Hmm, maybe I'll stop it in Task Manager, do an Erunt and restore the >> registry. Well, maybe I don't know.
Hi Wally, Go to Start then Search and Enter dllhost. Search the Local Hard Drive and all Hidden Files and Folders. Take a look at the Date of the file. You should have a File Creation Date of 8/4/2004 with the mouse hovering over the name. Date Modified is the Date it was installed on the computer. -- thecreator "WaIIy" <WaIIy@(nft).invalid> wrote in message news69p56t063dtn0htun0h9d76tevn1vfd21@4ax.com... > > I don't recall installing anything new lately. > > All of a sudden, I have two instances of dllhost.exe running in Task > Manager upon boot. > > If I kill them and their processes, there is no ill effect. > > Yes, I've scanned and also run Avira and Zone Alarm Pro. > > I'd like to get rid of them. > Thanks
See: http://searchtasks.answersthatwork.com/tasklist.php?File=DLLHost WaIIy wrote: > I haven't quite nailed it down, but I think it has to do with Java. > > I uninstalled Java and the two dllhost.exe don't show in Task manager > upon boot. > > I'll keep you posted if you'd like.
On 8/7/2010 62 PM, WaIIy wrote: > > I haven't quite nailed it down, but I think it has to do with Java. > > I uninstalled Java and the two dllhost.exe don't show in Task manager > upon boot. > > I'll keep you posted if you'd like. > > > > On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]" > <PABearMVP@gmail.com> wrote: > >> So what's causing the two instances of DLLHOST.EXE to load at boot? <snip> Would pocess explorer help with this? http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded. The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded. The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work
On Sat, 07 Aug 2010 18:44:20 -0700, Mike S <mscir@yahoo.com> wrote: >On 8/7/2010 62 PM, WaIIy wrote: >> >> I haven't quite nailed it down, but I think it has to do with Java. >> >> I uninstalled Java and the two dllhost.exe don't show in Task manager >> upon boot. >> >> I'll keep you posted if you'd like. >> >> >> >> On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]" >> <PABearMVP@gmail.com> wrote: >> >>> So what's causing the two instances of DLLHOST.EXE to load at boot? ><snip> > >Would pocess explorer help with this? > >http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx > I looked with PE. I could see the two dllhost.exe , but couldn't make sense of what they were connected to.
Yup, Aug 4, 2004 for dllhost.exe Anyway, I solved it. I opened Revo Uninstaller and noticed I had two different Java updates in there. ( damn things showed 90 megs) I uninstalled all Java. I found the firefox Java dll in Firefox and deleted it. Reboot I installed newest Java (The new one shows 90.95 megs but no way I downloaded 90 megs, must be some kind of error) Went to Java icon in Control Panel set - no auto update - no quickstart-no cache Java works fine in Firefox. No dllhost.exe in Task Manager Reboot No dllhost.exe in Task Manager Odd thing, eh? On Sat, 7 Aug 2010 212:57 -0400, "thecreator" <thecreator@home.com> wrote: >Hi Wally, > > Go to Start then Search and Enter dllhost. > > Search the Local Hard Drive and all Hidden Files and Folders. Take a >look at the Date of the file. > > You should have a File Creation Date of 8/4/2004 with the mouse hovering >over the name. Date Modified is the Date it was installed on the computer.
Thanks I looked at that before and don't have that registry key. I disabled half of my Services and that didn't do me any good. On Sat, 7 Aug 2010 21:40:44 -0400, "Daave" <daave@example.com> wrote: >See: > >http://searchtasks.answersthatwork.com/tasklist.php?File=DLLHost > >WaIIy wrote: >> I haven't quite nailed it down, but I think it has to do with Java. >> >> I uninstalled Java and the two dllhost.exe don't show in Task manager >> upon boot. >> >> I'll keep you posted if you'd like. >
On 8/7/2010 6:46 PM, WaIIy wrote: > On Sat, 07 Aug 2010 18:44:20 -0700, Mike S<mscir@yahoo.com> wrote: > >> On 8/7/2010 62 PM, WaIIy wrote: >>> >>> I haven't quite nailed it down, but I think it has to do with Java. >>> >>> I uninstalled Java and the two dllhost.exe don't show in Task manager >>> upon boot. >>> >>> I'll keep you posted if you'd like. >>> >>> >>> >>> On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]" >>> <PABearMVP@gmail.com> wrote: >>> >>>> So what's causing the two instances of DLLHOST.EXE to load at boot? >> <snip> >> >> Would pocess explorer help with this? >> >> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx >> > > I looked with PE. I could see the two dllhost.exe , but couldn't make > sense of what they were connected to. post the results if you'd like more folks to look at them.
On 8/7/2010 6:46 PM, WaIIy wrote: > On Sat, 07 Aug 2010 18:44:20 -0700, Mike S<mscir@yahoo.com> wrote: > >> On 8/7/2010 62 PM, WaIIy wrote: >>> >>> I haven't quite nailed it down, but I think it has to do with Java. >>> >>> I uninstalled Java and the two dllhost.exe don't show in Task manager >>> upon boot. >>> >>> I'll keep you posted if you'd like. >>> >>> >>> >>> On Sat, 7 Aug 2010 15:50:18 -0400, "PA Bear [MS MVP]" >>> <PABearMVP@gmail.com> wrote: >>> >>>> So what's causing the two instances of DLLHOST.EXE to load at boot? >> <snip> >> >> Would pocess explorer help with this? >> >> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx >> > > I looked with PE. I could see the two dllhost.exe , but couldn't make > sense of what they were connected to. How about giving Process Monitor a try? http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.