DLLHOST.exe

[Rob]

Good afternoon,
Could anyone offer an explanation on what
the 'DLLHOST.exe' file actually does?
What purpose does it serve? And what might activate it?

Thanks,
Rob

 

[Warren Young]

Good afternoon,
Could anyone offer an explanation on what
the 'DLLHOST.exe' file actually does?
What purpose does it serve? And what might activate it?

Thanks,
Rob

dllhost is the host process for all COM+ applications and will be
present on an IIS system. If IIS is not running on this box, you may
have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.

Warren

 

[David H. Lipman]

Not entirely true....
Win2K has DLLHOST.EXE. On a KNOWN virus free Win2K SP4 PC, the file is v5.0.2195.6692

If it was an infected file, it could be the Nachi/Welchia worms, the Winkiller Trojan or
the W32/Chowl@MM worm.

Dave



| On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
|
| >Good afternoon,
| >Could anyone offer an explanation on what
| >the 'DLLHOST.exe' file actually does?
| >What purpose does it serve? And what might activate it?
| >
| >Thanks,
| >Rob
|
| dllhost is the host process for all COM+ applications and will be
| present on an IIS system. If IIS is not running on this box, you may
| have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
|
| Warren

 

[Rob]

Should more than one instance of DLLHOST.ext be running at
any given time? Or should you only ever see one instance
in the task manager?
I've monitored the task manager and seen a second instance
randomly appear sometimes.

 

[Warren Young]

Not entirely true....
Win2K has DLLHOST.EXE. On a KNOWN virus free Win2K SP4 PC, the file is v5.0.2195.6692

If it was an infected file, it could be the Nachi/Welchia worms, the Winkiller Trojan or
the W32/Chowl@MM worm.

Dave



| On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
|
| >Good afternoon,
| >Could anyone offer an explanation on what
| >the 'DLLHOST.exe' file actually does?
| >What purpose does it serve? And what might activate it?
| >
| >Thanks,
| >Rob
|
| dllhost is the host process for all COM+ applications and will be
| present on an IIS system. If IIS is not running on this box, you may
| have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
|
| Warren

True. I wasn't 100% clear in my answer.

Warren

 

[Warren Young]

Should more than one instance of DLLHOST.ext be running at
any given time? Or should you only ever see one instance
in the task manager?
I've monitored the task manager and seen a second instance
randomly appear sometimes.

If IIS is configured to use isolated processes, you will see an
additional dllhost.exe instance in Task Manager for each site that is
configured in this manner. However, I have never seen them come and go
at random.

Warren

 

[David H. Lipman]

Yes. You can have multiple instances running.

Since that executable is the target of infectors, please go to McAfee
(http://www.mcafee.com/myapps/mfs/default.asp) and/or Trend
(http://housecall.antivirus.com ) and perform an online scan of your platform.

Please report back your results.

Dave



| Should more than one instance of DLLHOST.ext be running at
| any given time? Or should you only ever see one instance
| in the task manager?
| I've monitored the task manager and seen a second instance
| randomly appear sometimes.
|
|
| >-----Original Message-----
| >On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
| >
| >>Good afternoon,
| >>Could anyone offer an explanation on what
| >>the 'DLLHOST.exe' file actually does?
| >>What purpose does it serve? And what might activate it?
| >>
| >>Thanks,
| >>Rob
| >
| >dllhost is the host process for all COM+ applications and
| will be
| >present on an IIS system. If IIS is not running on this
| box, you may
| >have the Welchia worm aka MSBlast.D, LoveSan.D or Nachia.
| >
| >Warren
| >.
| >

 

[Rob]

The server is running Norton Antivirus Corporate Edition
and it updated regularly. The last update was received
two days ago. The problem we are having has been around
awhile.

 

[David H. Lipman]

Then I ask you to do the following. If nothing is found. No worries !

1) Reboot your PC into Safe Mode
2) Using your NAV software, perform a Full Scan of your platform and clean/delete any
infectors found
3) Restart your PC and perform a "final" Full Scan of your platform
4) Please report back your results


Dave



| The server is running Norton Antivirus Corporate Edition
| and it updated regularly. The last update was received
| two days ago. The problem we are having has been around
| awhile.
|
|
| >-----Original Message-----
| >Yes. You can have multiple instances running.
| >
| >Since that executable is the target of infectors, please
| go to McAfee
| >(http://www.mcafee.com/myapps/mfs/default.asp) and/or
| Trend
| >(http://housecall.antivirus.com ) and perform an online
| scan of your platform.
| >
| >Please report back your results.
| >
| >Dave
| >
| >
| >
| message
| >| >| Should more than one instance of DLLHOST.ext be running
| at
| >| any given time? Or should you only ever see one
| instance
| >| in the task manager?
| >| I've monitored the task manager and seen a second
| instance
| >| randomly appear sometimes.
| >|
| >|
| >| >-----Original Message-----
| >| >On Fri, 16 Jan 2004 11:22:19 -0800, "Rob"
| >| >
| >| >>Good afternoon,
| >| >>Could anyone offer an explanation on what
| >| >>the 'DLLHOST.exe' file actually does?
| >| >>What purpose does it serve? And what might activate
| it?
| >| >>
| >| >>Thanks,
| >| >>Rob
| >| >
| >| >dllhost is the host process for all COM+ applications
| and
| >| will be
| >| >present on an IIS system. If IIS is not running on this
| >| box, you may
| >| >have the Welchia worm aka MSBlast.D, LoveSan.D or
| Nachia.
| >| >
| >| >Warren
| >| >.
| >| >
| >
| >
| >.
| >

 

[Rob]

Thanks for the suggestion. I'll offer them to my manager
since there are processes running during business hours
that I do not want to distrupt.
I'll let you know if we find any viruses.
Thanks again.

-----Original Message-----
Then I ask you to do the following. If nothing is found. No worries !

1) Reboot your PC into Safe Mode
2) Using your NAV software, perform a Full Scan of

your platform and clean/delete any