DLLHOST.EXE annoy me!

[michael]

Recently Dllhost.exe constantly appeared in my Windows
Task Manager(it do not take too much resources but
sometimes has several copies here). I have checked for
virus with Mcefee Virusscan, and Stinger (for worm),
there are nothing found. (also I had checked the register
table and I'm sure it is not a W32/Nazi worm.)

After I turn on the XP firewall, dllhost.exe will not
appear again when system boot-up, but sometimes the
firewall be ture-off and the dllhost.exe appeared again.
I know the dllhost is for DCOM, and it should not stay in
Windows Task Manager, so there must be something wrong
with my system. Could anybody here give me a hint?

Thanks

 

[Malke]

Recently Dllhost.exe constantly appeared in my Windows
Task Manager(it do not take too much resources but
sometimes has several copies here). I have checked for
virus with Mcefee Virusscan, and Stinger (for worm),
there are nothing found. (also I had checked the register
table and I'm sure it is not a W32/Nazi worm.)

After I turn on the XP firewall, dllhost.exe will not
appear again when system boot-up, but sometimes the
firewall be ture-off and the dllhost.exe appeared again.
I know the dllhost is for DCOM, and it should not stay in
Windows Task Manager, so there must be something wrong
with my system. Could anybody here give me a hint?

You have the Welchia worm. Immediately disconnect your computer from the
Internet and any internal lan. You have Stinger, which I believe takes
care of it, or else download the removal tool (from a different
computer!) from Symantec. Also download the necessary patches from
Windows Update and burn them to a disk. Then go to your sick computer.
Disable System Restore. Go into Safe Mode. Run the removal tool. Run
Stinger and your current av (assuming that definitions are up-to-date).
Then you can go into regular mode, but still disconnected from any
networks. Apply the patches. Reenable System Restore. *Now* you can
reconnect to the Internet/lan.

Malke

 

[Guest]

Thanks for your reply, but I don't think it is Welchia
worm which usually located at \Windows\System32\wins\ and
some special place in register table, that is quite easy
to identicate. So, any other hint?

Michael

 

[Malke]

Thanks for your reply, but I don't think it is Welchia
worm which usually located at \Windows\System32\wins\ and
some special place in register table, that is quite easy
to identicate. So, any other hint?

Michael

Did you disable System Restore and the rest of it before scanning again
in Safe Mode?

Malke