Good afternoon,
Could anyone offer an explanation on what
the 'DLLHOST.exe' file actually does?
What purpose does it serve? And what might activate it?

Thanks,
Rob

On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
<(E-Mail Removed)> wrote:

>Good afternoon,
>Could anyone offer an explanation on what
>the 'DLLHOST.exe' file actually does?
>What purpose does it serve? And what might activate it?
>
>Thanks,
>Rob

dllhost is the host process for all COM+ applications and will be
present on an IIS system. If IIS is not running on this box, you may
have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.

Warren

Not entirely true....
Win2K has DLLHOST.EXE. On a KNOWN virus free Win2K SP4 PC, the file is v5.0.2195.6692

If it was an infected file, it could be the Nachi/Welchia worms, the Winkiller Trojan or
the W32/Chowl@MM worm.

Dave



"Warren Young" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
| On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
| <(E-Mail Removed)> wrote:
|
| >Good afternoon,
| >Could anyone offer an explanation on what
| >the 'DLLHOST.exe' file actually does?
| >What purpose does it serve? And what might activate it?
| >
| >Thanks,
| >Rob
|
| dllhost is the host process for all COM+ applications and will be
| present on an IIS system. If IIS is not running on this box, you may
| have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
|
| Warren

Should more than one instance of DLLHOST.ext be running at
any given time? Or should you only ever see one instance
in the task manager?
I've monitored the task manager and seen a second instance
randomly appear sometimes.


>-----Original Message-----
>On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
><(E-Mail Removed)> wrote:
>
>>Good afternoon,
>>Could anyone offer an explanation on what
>>the 'DLLHOST.exe' file actually does?
>>What purpose does it serve? And what might activate it?
>>
>>Thanks,
>>Rob
>
>dllhost is the host process for all COM+ applications and
will be
>present on an IIS system. If IIS is not running on this
box, you may
>have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
>
>Warren
>.
>

On Fri, 16 Jan 2004 14:43:32 -0500, "David H. Lipman"
<DLipman~nospam~@Verizon.Net> wrote:

>Not entirely true....
>Win2K has DLLHOST.EXE. On a KNOWN virus free Win2K SP4 PC, the file is v5.0.2195.6692
>
>If it was an infected file, it could be the Nachi/Welchia worms, the Winkiller Trojan or
>the W32/Chowl@MM worm.
>
>Dave
>
>
>
>"Warren Young" <(E-Mail Removed)> wrote in message
>news:(E-Mail Removed)...
>| On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
>| <(E-Mail Removed)> wrote:
>|
>| >Good afternoon,
>| >Could anyone offer an explanation on what
>| >the 'DLLHOST.exe' file actually does?
>| >What purpose does it serve? And what might activate it?
>| >
>| >Thanks,
>| >Rob
>|
>| dllhost is the host process for all COM+ applications and will be
>| present on an IIS system. If IIS is not running on this box, you may
>| have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
>|
>| Warren
>

True. I wasn't 100% clear in my answer.

Warren

On Fri, 16 Jan 2004 11:46:14 -0800, "Rob"
<(E-Mail Removed)> wrote:

>Should more than one instance of DLLHOST.ext be running at
>any given time? Or should you only ever see one instance
>in the task manager?
>I've monitored the task manager and seen a second instance
>randomly appear sometimes.
>
>
>>-----Original Message-----
>>On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
>><(E-Mail Removed)> wrote:
>>
>>>Good afternoon,
>>>Could anyone offer an explanation on what
>>>the 'DLLHOST.exe' file actually does?
>>>What purpose does it serve? And what might activate it?
>>>
>>>Thanks,
>>>Rob
>>
>>dllhost is the host process for all COM+ applications and
>will be
>>present on an IIS system. If IIS is not running on this
>box, you may
>>have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
>>
>>Warren
>>.
>>

If IIS is configured to use isolated processes, you will see an
additional dllhost.exe instance in Task Manager for each site that is
configured in this manner. However, I have never seen them come and go
at random.

Warren

Yes. You can have multiple instances running.

Since that executable is the target of infectors, please go to McAfee
(http://www.mcafee.com/myapps/mfs/default.asp) and/or Trend
(http://housecall.antivirus.com ) and perform an online scan of your platform.

Please report back your results.

Dave



"Rob" <(E-Mail Removed)> wrote in message
news:006801c3dc69$66476e60$(E-Mail Removed)...
| Should more than one instance of DLLHOST.ext be running at
| any given time? Or should you only ever see one instance
| in the task manager?
| I've monitored the task manager and seen a second instance
| randomly appear sometimes.
|
|
| >-----Original Message-----
| >On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
| ><(E-Mail Removed)> wrote:
| >
| >>Good afternoon,
| >>Could anyone offer an explanation on what
| >>the 'DLLHOST.exe' file actually does?
| >>What purpose does it serve? And what might activate it?
| >>
| >>Thanks,
| >>Rob
| >
| >dllhost is the host process for all COM+ applications and
| will be
| >present on an IIS system. If IIS is not running on this
| box, you may
| >have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
| >
| >Warren
| >.
| >

The server is running Norton Antivirus Corporate Edition
and it updated regularly. The last update was received
two days ago. The problem we are having has been around
awhile.


>-----Original Message-----
>Yes. You can have multiple instances running.
>
>Since that executable is the target of infectors, please
go to McAfee
>(http://www.mcafee.com/myapps/mfs/default.asp) and/or
Trend
>(http://housecall.antivirus.com ) and perform an online
scan of your platform.
>
>Please report back your results.
>
>Dave
>
>
>
>"Rob" <(E-Mail Removed)> wrote in
message
>news:006801c3dc69$66476e60$(E-Mail Removed)...
>| Should more than one instance of DLLHOST.ext be running
at
>| any given time? Or should you only ever see one
instance
>| in the task manager?
>| I've monitored the task manager and seen a second
instance
>| randomly appear sometimes.
>|
>|
>| >-----Original Message-----
>| >On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
>| ><(E-Mail Removed)> wrote:
>| >
>| >>Good afternoon,
>| >>Could anyone offer an explanation on what
>| >>the 'DLLHOST.exe' file actually does?
>| >>What purpose does it serve? And what might activate
it?
>| >>
>| >>Thanks,
>| >>Rob
>| >
>| >dllhost is the host process for all COM+ applications
and
>| will be
>| >present on an IIS system. If IIS is not running on this
>| box, you may
>| >have the Welchia worm aka MSBlast.D, LoveSan.D or
Nachia.
>| >
>| >Warren
>| >.
>| >
>
>
>.
>

Then I ask you to do the following. If nothing is found. No worries !

1) Reboot your PC into Safe Mode
2) Using your NAV software, perform a Full Scan of your platform and clean/delete any
infectors found
3) Restart your PC and perform a "final" Full Scan of your platform
4) Please report back your results


Dave



"Rob" <(E-Mail Removed)> wrote in message
news:037b01c3dc6f$de661b20$(E-Mail Removed)...
| The server is running Norton Antivirus Corporate Edition
| and it updated regularly. The last update was received
| two days ago. The problem we are having has been around
| awhile.
|
|
| >-----Original Message-----
| >Yes. You can have multiple instances running.
| >
| >Since that executable is the target of infectors, please
| go to McAfee
| >(http://www.mcafee.com/myapps/mfs/default.asp) and/or
| Trend
| >(http://housecall.antivirus.com ) and perform an online
| scan of your platform.
| >
| >Please report back your results.
| >
| >Dave
| >
| >
| >
| >"Rob" <(E-Mail Removed)> wrote in
| message
| >news:006801c3dc69$66476e60$(E-Mail Removed)...
| >| Should more than one instance of DLLHOST.ext be running
| at
| >| any given time? Or should you only ever see one
| instance
| >| in the task manager?
| >| I've monitored the task manager and seen a second
| instance
| >| randomly appear sometimes.
| >|
| >|
| >| >-----Original Message-----
| >| >On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
| >| ><(E-Mail Removed)> wrote:
| >| >
| >| >>Good afternoon,
| >| >>Could anyone offer an explanation on what
| >| >>the 'DLLHOST.exe' file actually does?
| >| >>What purpose does it serve? And what might activate
| it?
| >| >>
| >| >>Thanks,
| >| >>Rob
| >| >
| >| >dllhost is the host process for all COM+ applications
| and
| >| will be
| >| >present on an IIS system. If IIS is not running on this
| >| box, you may
| >| >have the Welchia worm aka MSBlast.D, LoveSan.D or
| Nachia.
| >| >
| >| >Warren
| >| >.
| >| >
| >
| >
| >.
| >

Thanks for the suggestion. I'll offer them to my manager
since there are processes running during business hours
that I do not want to distrupt.
I'll let you know if we find any viruses.
Thanks again.

>-----Original Message-----
>Then I ask you to do the following. If nothing is
found. No worries !
>
>1) Reboot your PC into Safe Mode
>2) Using your NAV software, perform a Full Scan of
your platform and clean/delete any
> infectors found
>3) Restart your PC and perform a "final" Full Scan of
your platform
>4) Please report back your results
>
>
>Dave
>
>
>
>"Rob" <(E-Mail Removed)> wrote in
message
>news:037b01c3dc6f$de661b20$(E-Mail Removed)...
>| The server is running Norton Antivirus Corporate Edition
>| and it updated regularly. The last update was received
>| two days ago. The problem we are having has been around
>| awhile.
>|
>|
>| >-----Original Message-----
>| >Yes. You can have multiple instances running.
>| >
>| >Since that executable is the target of infectors,
please
>| go to McAfee
>| >(http://www.mcafee.com/myapps/mfs/default.asp) and/or
>| Trend
>| >(http://housecall.antivirus.com ) and perform an online
>| scan of your platform.
>| >
>| >Please report back your results.
>| >
>| >Dave
>| >
>| >
>| >
>| >"Rob" <(E-Mail Removed)> wrote in
>| message
>| >news:006801c3dc69$66476e60$(E-Mail Removed)...
>| >| Should more than one instance of DLLHOST.ext be
running
>| at
>| >| any given time? Or should you only ever see one
>| instance
>| >| in the task manager?
>| >| I've monitored the task manager and seen a second
>| instance
>| >| randomly appear sometimes.
>| >|
>| >|
>| >| >-----Original Message-----
>| >| >On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
>| >| ><(E-Mail Removed)> wrote:
>| >| >
>| >| >>Good afternoon,
>| >| >>Could anyone offer an explanation on what
>| >| >>the 'DLLHOST.exe' file actually does?
>| >| >>What purpose does it serve? And what might
activate
>| it?
>| >| >>
>| >| >>Thanks,
>| >| >>Rob
>| >| >
>| >| >dllhost is the host process for all COM+
applications
>| and
>| >| will be
>| >| >present on an IIS system. If IIS is not running on
this
>| >| box, you may
>| >| >have the Welchia worm aka MSBlast.D, LoveSan.D or
>| Nachia.
>| >| >
>| >| >Warren
>| >| >.
>| >| >
>| >
>| >
>| >.
>| >
>
>
>.
>