Tough I removed it, I do not know what it is: dllhost32 data resources hidden folder

[Rebecca2000]

Tough I removed it, I do not know what it is.

Have anyone ever seen a virus/spyware with such things:
Dllhost32.exe
Most exe files have a daemon under hidden subfolder
"\data\resources\", and the size of the daemon is 16KB. The
shortcuts to the exe are changed to pointing to the daemon.

Thus, when I launched a program through short cuts, the daemon will be
launched, and then the daemon launch the original exe.

I am running XP Pro.

As I checked newsgroups about Dllhost32.exe, most posts pointed out
dllhost32 is spyware, but did not explain why there are daemon exe
files and hidden folder. So I am not so sure what my computer got
infected.

I used Spybot, Kaspersky and Adware to check, they all failed to find
anything.

I eventually delete all these 16KB daemon files, and leave those hidden
folder alone, by searching files and deleted. And I wrote a small
program to convert all shortcuts under "Documents and Settings" to
make them point to the original one, by removing string
"\data\resources"

No problem ever since. I suppose I am not the only one getting these.
Just strange enough no one mentioned in news groups. I did search
"dllhost32 data resources hidden".

Can anyone identify what was happing?

Cheers

 

[David H. Lipman]

From: <[email protected]>

| Tough I removed it, I do not know what it is.
|
| Have anyone ever seen a virus/spyware with such things:
| Dllhost32.exe
| Most exe files have a daemon under hidden subfolder
| "\data\resources\", and the size of the daemon is 16KB. The
| shortcuts to the exe are changed to pointing to the daemon.
|
| Thus, when I launched a program through short cuts, the daemon will be
| launched, and then the daemon launch the original exe.
|
| I am running XP Pro.
|
| As I checked newsgroups about Dllhost32.exe, most posts pointed out
| dllhost32 is spyware, but did not explain why there are daemon exe
| files and hidden folder. So I am not so sure what my computer got
| infected.
|
| I used Spybot, Kaspersky and Adware to check, they all failed to find
| anything.
|
| I eventually delete all these 16KB daemon files, and leave those hidden
| folder alone, by searching files and deleted. And I wrote a small
| program to convert all shortcuts under "Documents and Settings" to
| make them point to the original one, by removing string
| "\data\resources"
|
| No problem ever since. I suppose I am not the only one getting these.
| Just strange enough no one mentioned in news groups. I did search
| "dllhost32 data resources hidden".
|
| Can anyone identify what was happing?
|
| Cheers

Read the following... does its information match what's on your PC ?

http://www.sophos.com/virusinfo/analyses/w32nauticala.html

 

[Duane Arnold]

Tough I removed it, I do not know what it is.

Have anyone ever seen a virus/spyware with such things:
Dllhost32.exe
Most exe files have a daemon under hidden subfolder
"\data\resources\", and the size of the daemon is 16KB. The
shortcuts to the exe are changed to pointing to the daemon.

Thus, when I launched a program through short cuts, the daemon will be
launched, and then the daemon launch the original exe.

I am trying to figure out what you're talking about.

I am running XP Pro.

As I checked newsgroups about Dllhost32.exe, most posts pointed out
dllhost32 is spyware, but did not explain why there are daemon exe
files and hidden folder. So I am not so sure what my computer got
infected.

Yeah, Dllhost32.exe host Dll(s) like ProgramName.dll.

I used Spybot, Kaspersky and Adware to check, they all failed to find
anything.

I eventually delete all these 16KB daemon files, and leave those hidden
folder alone, by searching files and deleted. And I wrote a small
program to convert all shortcuts under "Documents and Settings" to
make them point to the original one, by removing string
"\data\resources"

I am still trying to figure out what you're talking about here.

No problem ever since. I suppose I am not the only one getting these.
Just strange enough no one mentioned in news groups. I did search
"dllhost32 data resources hidden".

Can anyone identify what was happing?

Dllhost32.exe is a valid NT based MS O/S component if it's running out
of (Windows) for XP or higher and (Winnt) Win 2K or lower NT based
O/S(s), like C:\windows\system32 or c:\Winnt\System32.

If dllhost32.exe is not running out of either one of the folders above
based what O/S is being used, then it's a Trojan that is running and you
needed to get rid of it.

How did you know from what directory was dllhost.exe running out of? And
do you know for sure that whatever Dllhost32.exe you're talking about
was actually running?

Duane

 

[Duane Arnold]

I am running XP Pro.

Oops, I have XP Pro too and the valid one used by the Win XP O/S is
dllhost.exe out of the C:\Windows\System32.

So, if you had some dllhost32.exe that was running, then it was possibly
some kind of malware.

Duane

 

[Rebecca2000]

Thanks, pals. Just how amazing Kaspersky and Spybot and other well
known programs could not spot this out. Luckly there are still pals
knowing this.

 

[Lakota67]

If you find more info let me know - I had the same infection which I
removed manually - which sucked.