1
   

Is this a necessary file?

 
 
Reply Tue 6 Mar, 2007 11:40 am
I have a virus in this file :

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dllhost



and the scan quarantine was unsuccessful numerous times. I can manually delete it, but I need to know if it is a necessary file first
  • Topic Stats
  • Top Replies
  • Link to this Topic
Type: Discussion • Score: 1 • Views: 419 • Replies: 4
No top replies

 
contrex
 
  1  
Reply Tue 6 Mar, 2007 02:04 pm
Re: Is this a necessary file?
Delete it. There is a Windows system file of the same name, but it would NEVER, EVER be found in that location, namely your start menu "all users" startup folder. It is often put there by the Loveleter.A worm!

Delete it and watch to see if it returns.
0 Replies
 
jespah
 
  1  
Reply Tue 6 Mar, 2007 04:56 pm
musicobsessed575, I suggest you wait for another opinion.

contrex, I suggest you stop fooling around.
0 Replies
 
contrex
 
  1  
Reply Wed 7 Mar, 2007 10:25 am
jespah, I am sorry if you think I am fooling around. I can assure you, and musicobsessed575, that I am perfectly serious.

jespah, what reason have you got for making that accusation, other than a distasteful mixture of ignorance and spite? I call BS and request you give your reasons. I daresay you are too cowardly to do so.

I am familiar with Windows system files, and I was surprised to see that file, with that name, in that location.

The start menu, in Windows, contains a folder called "startup". Programs, or shortcuts to programs, which are placed there will be run when Windows starts up. The purpose of having this is so that programs installed by the user (and this is important) can run automatically when Windows starts. Programs such as antivirus programs, anti spyware apps, filesharing programs, email apps, little utilities eg fancy taskbar clocks, etc all fall into this category.

If the Windows installation has named users, each user will have their own startup folder. In addition, there is an "all users" folder for programs which are needed to start whoever logs in.

What it is not intended for, is starting the normal Windows services such as the dllhost service. These are started in a different fashion, before user logon.

Naming a trojan executable with the same name as a Windows service, and dropping it into the user startup folder is a common tactic used by authors of malware.

The "all users" startup folder is a good bet for planting a trojan, because the author cannot know in advance the user names (if any) on his target machines, but he will be aware that all machines have an "all users" folder.

For the reasons I have just outlined, i was suspicious that the file described by musicobsessed575 was some kind of malicious executable, a virus or trojan.

So I checked using Google. (You should have done this before shooting off your mouth, jespah.) I typed "dllhost startup", and i soon found plenty of information, upon which I based the reply which I posted.

I discovered that, as I suspected, dllhost.exe, out of its proper place, and not started as a process, is most likely a virus.

I include the following references:-

(1)

http://www.neuber.com/taskmanager/process/dllhost.exe.html

Quote:
The COM+ hosting process controls processes in the Internet Information Services (IIS) and is used by many programs. It loads .NET Runtime for example. There can be multiple instances of DLLhost.exe.

Note: The dllhost.exe file is located in the folder C:\Windows\System32. In other cases, dllhost.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Virus with same name:
Worm/Nachi.A.1 - antivir.de


(2)

http://www.castlecops.com/s11548-dllhost_dll.html

Quote:
!! THIS IS A STARTUP PROGRAM AND NOT A TASK MANAGER PROCESS ITEM !!
Field Value
Name DLL32
Command dllhost.dll
Status X
Description Added by the LOVELETER.A WORM!
Viewed 1007 times since 23 May 2005, 1825 Hours UTC-4.
STATUS KEY:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown


so, musicobsessed575, my advice stands. That dllhost program in your start menu\all users\startup folder is very likely a virus, as you have actually been warned, it seems. It is not the Windows system file of the same name, which belongs elsewhere, and you will do your system nothing but good by deleting it. Jespah may have placed your system in unnecessary danger by posting his foolish and spiteful nonsense.

It seems that jespah is behaving like a malicious troll. Trying to confuse you out of removing a virus from your system is creepy behavior in my opinion.

jespah, I would like you to explain why you accused me of "fooling around", and I would like an apology. I expect you are too cowardly to offer one, so I am thinking of complaining to the moderators about what you have done.
0 Replies
 
jespah
 
  1  
Reply Wed 7 Mar, 2007 04:47 pm
contrex, I'm sorry you feel that way. Since I've seen
http://www.able2know.com/forums/viewtopic.php?p=2519177#2519177 and -- http://www.able2know.com/forums/viewtopic.php?p=2548031#2548031 , I was concerned about off the cuff and/or incorrect information. Thank you for providing sources for your statement that's it okay to remove that file. I am sorry that I said you were "fooling around" or if I have caused you any other pain.

As for calling me cowardly, foolish, trolling and spiteful, you're certainly entitled to your opinion. And it's okay, I don't need an apology. Smile

Oh, and please feel free to contact the Moderating team if you feel you've been wronged. A topic about how to do that is in the Announcements forum. See: http://www.able2know.com/forums/viewtopic.php?t=89566
0 Replies
 
 

Related Topics

Clone of Micosoft Office - Question by Advocate
Do You Turn Off Your Computer at Night? - Discussion by Phoenix32890
The "Death" of the Computer Mouse - Discussion by Phoenix32890
Windows 10... - Discussion by Region Philbis
Surface Pro 3: What do you think? - Question by neologist
Windows 8 tips thread - Discussion by Wilso
GOOGLE CHROME - Question by Setanta
.Net and Firefox... - Discussion by gungasnake
Hacking a computer and remote access - Discussion by trying2learn
 
  1. Forums
  2. » Is this a necessary file?
Copyright © 2025 MadLab, LLC :: Terms of Service :: Privacy Policy :: Page generated in 0.04 seconds on 06/22/2025 at 04:01:53