Virus in winnt/system32/dllhost.exe

[ramesh]

Hello everyone,

I need help with the following:
Routine virus scan revealed a virus in the file
c:\winnt\system32\dllhost.exe

scan could not clea, or quarantine the file.
So, I deleted the file, but some how another directory
under system32 by name wins got created and dllhost.exe
too. I ran the scan again, and caught the dllhost.exe.
This time I could not delete as access was denied.

1. is dllhost a system file that needs to be there?
2. should i not delete. if so, how to get a new one and
get rid of the infected file?

Thanks in advance
Ramesh

 

[phoenix]

Hello everyone,

I need help with the following:
Routine virus scan revealed a virus in the file
c:\winnt\system32\dllhost.exe

scan could not clea, or quarantine the file.
So, I deleted the file, but some how another directory
under system32 by name wins got created and dllhost.exe
too. I ran the scan again, and caught the dllhost.exe.
This time I could not delete as access was denied.

1. is dllhost a system file that needs to be there?
2. should i not delete. if so, how to get a new one and
get rid of the infected file?

Thanks in advance
Ramesh

I would suggest that most, if not all, the files in \windows\system32 *are*
system files and you shouldn't just delete them without knowing what you're
doing. Have a look here http://tinyurl.com/mimu for some more information
on your problem.

Regards

Bill

 

[Henry Johnson]

Both Symantec and McAfee have virus removal tools. I
would recommend the Symantec tool since it is the easiest
to get to. You have the Nachi worm (aka, Welchia)
Symantec's antivirus removal tool is called the FixWelch
Tool and it is freely available at www.sarc.com.