DLLHOST.EXE

[Guest]

My firewall alerted me to a program trying to access the internet. DLLHOST.EXE(all caps) I could not deleatethe file. The firewall labels the file a virus. There was also a file dllhost.exe(small caps) that I could delete.

My question is; are these files viruses or windows files??

Thanks

Lynn

 

[William R. Walsh]

Hi!

DLLHOST.EXE is a part of Windows...the DCOM subsystem to be exact. Do not
delete it. This file isn't (by itself) a virus, but there are exploits for
DCOM running around in great numbers right now...this may be why your
firewall feels that the DLLHOST.EXE file is a virus.

William

 

[Guest]

Hi,
This is probably the nachi virus which is a strain of the
MSBlast virus, do a search on nachi virus and you will be
given information as to how to detect whether it is
infected. I cant remember the exact size but I think if
the DLLHOST.exe is over 10k its infected. Do a search on
the trend micro site and you will find a detection tool.


Cheers

 

[Guest]

Have a look in the c:\winnt\system32\wins directory. This
is created by the Nachi virus and installs two file
DLLHOST and SYSHOST.DLL. These are stated as services and
therefore can't be deleted before these services are
stopped. One is WINS service, have a look at the
properties of this service and it probably points to the
c:\winnt\system32\wins directory, and the other is a
Network connections service (or something similar)

Disable and stop both these services, delete the files
from the c:\winnt\system32\wins directory, update your
anti virus and install the latest windows security patches.

That should sort you out.

Paul

-----Original Message-----
My firewall alerted me to a program trying to access the

internet. DLLHOST.EXE(all caps) I could not deleatethe
file. The firewall labels the file a virus. There was also
a file dllhost.exe(small caps) that I could delete.

 

[David Bowen]

Been there...done this....
Go to the Symantec web site and look
for the Welchia worm definition which
will lead you to a scan/fix download
called "Fixwelch.exe". Run it to remove
the infected files. If you have deleted
the dllhost.dll (5kb in size) from the
\windows\system32 folder then you will
have to replace it as this is not the
infected file


My firewall alerted me to a program trying to access the internet.
DLLHOST.EXE(all caps) I could not deleatethe file. The firewall labels the
file a virus. There was also a file dllhost.exe(small caps) that I could
delete.

My question is; are these files viruses or windows files??

Thanks

Lynn

 

[David Bowen]

OOPS...not dllhost.dll but dllhost.exe...sorry!!
Been there...done this....
Go to the Symantec web site and look
for the Welchia worm definition which
will lead you to a scan/fix download
called "Fixwelch.exe". Run it to remove
the infected files. If you have deleted
the dllhost.dll (5kb in size) from the
\windows\system32 folder then you will
have to replace it as this is not the
infected file


My firewall alerted me to a program trying to access the internet.
DLLHOST.EXE(all caps) I could not deleatethe file. The firewall labels the
file a virus. There was also a file dllhost.exe(small caps) that I could
delete.

My question is; are these files viruses or windows files??

Thanks

Lynn