Computing.Net > Forums > Windows XP > DLLHOST.EXE is a virus on XP

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to get for your free account now!

DLLHOST.EXE is a virus on XP

Reply to Message Icon

Name: Wendy Hernandez
Date: August 23, 2003 at 08:34:37 Pacific
OS: Windows XP Home Edition
CPU/Ram: HP
Comment:

When I try to delete dllhost.exe on XP it won't allow me. It allowed to delete Ms_BLAST.exe but not the other one. Any idea how to get rid of it. My anti-virus detects it's a virus but won't clean and when I try to manually, it won't let me. When I try to go the registry, the window comes up for 5 seconds and goes away. Same thing with the processes tab. THe computer is no longer shutting down bc I deleted MS_Blast.exe but it is still not 100% clean.
HELP!


Report Offensive Message For Removal

Sponsored Link
Ads by Google

Response Number 1
Name: Chuck
Date: August 23, 2003 at 08:44:08 Pacific
Reply:

Find what DLLHOST.exe is, on this web page:

http://www.answersthatwork.com/Tasklist_pages/tasklist_d.htm

It is a Microsoft file.


Report Offensive Follow Up For Removal

Response Number 2
Name: keef444
Date: August 23, 2003 at 09:06:30 Pacific
Reply:

The system dllhosts file resides in system32, ur'll find the infected one is in C:\WINDOWS\system32\wins folder !!

If u open task manager, u will find it running, but u wont be able to shut it down !!

Just re-start in safe mode and u can safely delete it.

Hope this helps


Report Offensive Follow Up For Removal

Response Number 3
Name: arsenio
Date: August 25, 2003 at 13:47:29 Pacific
Reply:

seems like you catched the Welchia virus, refer to http://www.bitdefender.com/html/virusinfo.php?menu_id=1&v_id=151 or http://www.pchell.com/virus/welchia.shtml

if you are fond with windows you can follow the instructions and remove it manually, otherwise get the appropriate remover (check the links). i wouldn't just delete the file but it probably does the job as well, yet not very properly. make sure however you install the patch


Report Offensive Follow Up For Removal

Response Number 4
Name: Arun JB
Date: September 2, 2003 at 04:14:57 Pacific
Reply:

This is a worm called w32.welchia.worm. I found this proggy trying to connect to the internet when zonealarm alerted me about it on my client's Win2kProf. I seemed to try and connect to every address in the range 192.168.y.z. Couldnt kill it with task manager so i searched the registry and found that it was loading up as a service called "Wins Client". I stopped the service using service manager, disabled it, used the NT Resource kit to un-install the service and everything seemed to work fine after rebooting. Note that i am still able to use the internet and browse all the other machines on the lan with this system, so I dont think it was a valid windows program.
Check out this page on Nortons site: http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html


Report Offensive Follow Up For Removal

Response Number 5
Name: michael
Date: September 3, 2003 at 21:51:37 Pacific
Reply:

I run into the same problem with Win2000. when I tried to remove dllhost.exe and csvhost.exe svchost.exe from the c:\windows\system32\wins directory. But I was able to rename them to different file name (arbitrary). Then restart the computer. After the computer is restarted, I was able to remove the renamed virus file.


Report Offensive Follow Up For Removal

Related Posts

See More



Response Number 6
Name: HP
Date: September 19, 2003 at 11:09:09 Pacific
Reply:

I came across this board because I was searching for some info on "dllhost.exe" the reason is because recently my computer has been infected with a lot of weird files so I have to check the Task Manager regularly and this time I saw 2 "dllhost.exe", 1 is SYSTEM and the other is IWAM_[mycomputer'sname], it looks really suspicious cuz I've never seen this before in Task Manager... I've read some threads saying that the infected files is in /System32/Wins/ but when I go there, there's no file in that folder, the only 1 "dllhost.exe" I found after doing a search is in the system32 folder and its size is 5kb and the name is lowercase, oh and 2 other .pf files in the windows/prefetch folder... So I'm wondering if my computer is infected with this virus that's been talked about or what? Thanks a lot for your attention!!!


Report Offensive Follow Up For Removal
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows XP Forum Home


Sponsored links

Ads by Google


Results for: DLLHOST.EXE is a virus on XP

IPSECPOL.exe will not run on XP www.computing.net/answers/windows-xp/ipsecpolexe-will-not-run-on-xp/29661.html

Can I setup a VPN on XP Pro? www.computing.net/answers/windows-xp/can-i-setup-a-vpn-on-xp-pro/161836.html

do i have Lsass.exe www.computing.net/answers/windows-xp/do-i-have-lsassexe/108060.html