Multipe 'dllhost.exe *32' processes showing up in task manager.

kingokrap · Oct 18, 2014

Hello,
I noticed my computer was reacting slowly and my internet had slowed to a stop. I opened task manager and noticed I had multiple dllhost.exe *32 running in the process list. Individually ending all of them restored things back to normal. Then about ten minutes later things slowed down again and I noticed all the dllhost.exe *32 process were running again. I googled it and saw it was a problem and here I am. I ran the READ ME RUN ME process and attached my logs.

Some things to note. While running Malwarebytes it didn't show any threats and didn't give me the export log button. I instead had to look under the history tab and then clicked on the application logs button on the left hand side. I opened the .xml file and copied and pasted everything it displayed into notepad and that is what is attached.

Also after running Rogue Killer a page opened in my web browser taking me to Ad Lice's site with instructions on how to remove Poweliks with rogue killer. I didn't do anything after, just thought I'd mention it. I bookmarked the page if you need me to link to it.

Almost forgot, while downloading the programs I noticed that IE kept disabling my downloads and I had to manually enable them each time I downloaded a program.

I think I covered all the bases. Please let me know if I missed anything or did anything wrong.

Thanks in advance,
Glen

Kestrel13! · Oct 19, 2014

Hello.

Can you attach the correct log from Malware Bytes please.

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[Tr.Poweliks] (X64) HKEY_USERS\.DEFAULT\Software\classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32 -> Found

[Tr.Poweliks] (X64) HKEY_USERS\S-1-5-21-1718683747-3220676656-3354627562-1000\Software\classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32 -> Found

[Tr.Poweliks] (X64) HKEY_USERS\S-1-5-18\Software\classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32 -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Re run Hitman and have it remove what it finds.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Now do this so I can see what remains....

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

kingokrap · Oct 19, 2014

Hi,

Where do I find the correct Malwarebytes log? Under the Application logs it has two protection logs and one scan log. When I exported the scan log as a .txt it just has- 'Malwarebytes Anti-Malware www.malwarebytes.org', but no other information. Do I need to run another scan? Should I continue with your other instructions or wait until I get the right Malwarebytes log attached?

Also, I've noticed that Norton is now giving me notifications about 'Trojan Powelik' and then the multiple dllhost.exe *32 starts showing up in task manager. Then immediately afterwards I get another warning from Norton about Trojan.Adclicker. Just thought I'd mention it because I wasn't getting anything from Norton yesterday.

Thanks,
Glen

Kestrel13! · Oct 19, 2014

Just run a fresh scan with MBAM, yes.

The complaints from Norton should quit after you have followed my instructions.

kingokrap · Oct 19, 2014

Hi,

Ok, after I ran Rogue Killer and deleted the items you instructed me to, I did not get an RKreport[2].txt file on my desktop. Could it have save somewhere else? Before I closed the program I clicked on the report button on the right hand side and saved that as '2nd RKreport' and that is what I attached.

Thanks,
Glen

Kestrel13! · Oct 20, 2014

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode. Any other mode is primarily used for troubleshooting and diagnostic purposes. You should look into some third party software to control start up's.

Have the alerts from Norton stopped?

kingokrap · Oct 20, 2014

Hi,

I switched to normal startup and after the restart I got a warning from Norton about Trojan Powelik and then another one right after about Trojan Ad Clicker, and the multiple dllhost.exe *32 began popping up.

Would CCleaner work to control startup?

Thanks,
Glen

Kestrel13! · Oct 20, 2014

Because you were not in normal start up, stuff could have been hiding. Sigh.

can you re run RogueKiller in normal start up, & attach log, and also do this please...

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

kingokrap · Oct 20, 2014

Hi,

Here are the new logs.

Thanks,
Glen

Kestrel13! · Oct 20, 2014

Fix item using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate this detection:

[Tr.Poweliks] (X64) HKEY_USERS\S-1-5-21-1718683747-3220676656-3354627562-1000\Software\classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32 -> Found

Place a checkmark next to this item, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

After clicking Fix exit HJT.

Now re run RogueKiller again (just a scan) and attach log.

chaslang · Oct 20, 2014

kingokrap said: ↑

Would CCleaner work to control startup?
Click to expand...

Absolutely not! It uses the MSconfig registry keys which is totally inappropriate. MSconfig registry keys should only be used by Microsoft Windows.

See this: Dealing with Startup Process

kingokrap · Oct 21, 2014

Hi,

Here are my newest logs. I still haven't gotten the RKreport[2].txt to appear on my desktop so I just labeled them RK1, the first log, and RK2, the one after I ran analyse.exe.

Kestrel13! · Oct 21, 2014

OK. Clean log. Is Norton still alerting? :confused

kingokrap · Oct 21, 2014

Hi,

Norton hasn't alerted since early this morning before I ran the last two Rogue Killer scans.

Thanks,
Glen

Kestrel13! · Oct 21, 2014

Ready for final steps?

kingokrap · Oct 21, 2014

Ready.

Thanks,
Glen

Kestrel13! · Oct 21, 2014

You're most welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

kingokrap · Oct 21, 2014

Hi,
Ran through the final steps. Just wanted to say thank you for all your help.

Thanks,
Glen

Kestrel13! · Oct 21, 2014

you are most welcome, Glen. Safe surfing!

Log in or Sign up

Multipe 'dllhost.exe *32' processes showing up in task manager.

kingokrap Private E-2

Attached Files:

RKreport_SCN_10182014_203946.log

Malware Bytes log.txt

TDSSKiller.3.0.0.40_18.10.2014_21.36.24_log.txt

HitmanPro_20141018_2153.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Attached Files:

2nd RKreport.log

JRT.txt

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Attached Files:

RKreport_SCN_10202014_180948.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

kingokrap Private E-2

Attached Files:

RK1.log

RK2.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Multipe 'dllhost.exe *32' processes showing up in task manager.

kingokrap Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

kingokrap Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kingokrap Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches