DLLHOST.EXE -- taking all the resources! Help!

[zveruga]

Hi,

My parents have been complaining of lag on their machine. It works fine for a while... then it starts slowing down to a crawl. I noticed in the task manager, that DLLHOST.EXE was taking up 99% of CPU cycles. Also, all available memory was in use. I stopped that process and everything was fine afterward, until the machine is restarted again.

Question: Should I just delete DLLHOST.EXE from the windows folder, or is it an important part of windoze? I am running XP pro. Thanks!

 

[fredtam]

Two things.
1. The MS_Blast worm will copy itself into that file. Handle accordingly ie. delete

2. DCOM support module for DLL based COM objects (DCOM = Distributed Component Object Model). DCOM is a software architecture model which is an intrinsic part of Windows, of most Microsoft products, and of many non-Microsoft products. In most cases you should never see DLLHOST in your Task List, as, typically, DLLHOST starts, does what it has to do, and then terminates. However, sometimes, if a Java COM object runs (this could happen if you are browsing the Internet and come to a page which has Java code), DLLHOST may not terminate, which is when you would see it in your Task List.

Recommendation :
Do not "End Task" it as there is no way to determine whether DLLHOST has completed its task or not. For the more advanced users, however, deleting the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Java VM\MSDebug" can often solve the problem of DLLHOST constantly appearing in the Task List.

 

[oog]

Depending on what is running, DLLHost may stay in the Task List for longer periods of time. If it has not been replaced by a virus, it should be considered a vital part of Windows. Don't delete it, unless you have verified that it has been replaced by a virus.

 

[TD77077]

I just had to remove a W32Welchiaworm infection from a Win 2000 Pro machine here at work this morning. It was residing in that very file. Symantec has a removal tool on their site.

 

[VicodiN]

Make sure you run that updated virus scan before you take the measures of deleting it... Panda offers a free online scan if you dont currently have one on your machine... If you have one, it would hurt to use this one after you run yours in order to be double sure.

 

[zveruga]

my roommate is having same issue with SVCHOST.EXE now. So recommendation is to go to symantec website, and then what?

 

[mechBgon]

Originally posted by: zveruga
my roommate is having same issue with SVCHOST.EXE now. So recommendation is to go to symantec website, and then what?

You can download a 15-day trial version of Norton Antivirus 2004. I would suggest disabling System Restore and deleting all System Restore files first. Also, go to Windows Update and get the computer(s) patched up, and install ZoneAlarm firewall software for an additional measure of protection.

 

[mechBgon]

BTW, you may also try the Symantec Stinger tool first if you want. But a full-blown scan of all files, with heuristics maxed out, kill-on-sight, would be the best bet.