| All comments about dllhost.exe: |
 Alex | Windows DCOM DLL Host Process |
 | memmory virus at this level what to do |
 Bhagawan das | ASP development See also: Link |
 | on web server 8 instances loaded using more then 200mb of memory caused server to run very slow and drop connections |
| | Consumes CPU resources to almost 100% but seems to do nothing. Must kill the process to get the server to respond properly again. The process re-spawns almost immediately. |
| Anonymous | Dot Net Framework |
| Matthias | |
| Andy | During the installation of Microsoft .NET Framework 1.1 Service Pack 1, ZoneAlarm firewall alerted me that dllhost.exe was trying to connect to the internet and it is a known malicious program. AVG6 scan found nothing. |
| sprite | legitimite part of windows update, if located in c:\windows\system32. But in c:\windows\system32\wins it can signal a worm. |
| Eric | Also asked me during .NET Framework 1.1 installation |
| | This file is loaded in the windows\system32 directory and is for the .net framework. However when located inthe windows\system 32\wins directory it is a virus. |
| -=ΞΩΔΡΞ=-™ | intalls with service pack 2 |
 Edward Shaw | Its a known malicious file. It calls upon other variants it can automatically download from the internet, to rummage more intently through your files for passwords, credit card numbers, and who knows what else. It can automatically call upon variants from the internet if they are needed. After doing this it emails all of the source that its gathered to various random emails ALL located in Kuwait and Russia. This is all we know about it at the moment we will try to get back to you with more. See also: Link |
| jim | That it slow down your interconnection |
| Palnus | dllhost.exe is a Windows DCOM DLL Host Process it run web applications dll based with IIS. Stop. No virus, everything can be a virus, notepad.exe also! |
| Allistair Lomax MCSD | This file produces a surrogate process in which to host COM+ applications, and is provided by Component Services in Windows 2000, Windows XP and Windows 2003 Server. COM+ allow for the development and use of distributed applications See also: Link |
| _XC_ | It came out of no where in my proces list, never saw it before. |
| Donovan | Dllhost executes dll's. It is not malicious by itself - it is the dll's it hosts that are the problem. If it is hosting a malicious dll then it is malicious. |
| TheBeast | All applications on computer freeze up, CPU maxed out, couldn't do anything, even Ctrl-Alt-Del took minutes to respond! Did an internal search and found the file in the directory it's apparently supposed to be stored in, also found another associated file under c:\windows\Prefetch called "DLLHOST.EXE-2B8A63A0.pf. Scanned both files with Kaspersky Antivirus Personal Pro |
| Michael | dllhost.exe provides the necessary hooks to allow existing COM DLLs to behave as a local (or remote) server by wrapping them into a surrogate process. The dllhost.exe utility will load COM-based DLLs and expose their functionality from a distinct process, leaving the COM servers code base unaltered (no need to change and recompile the source code). I used it for some software projects. |
| duggy | High memory usage when viewed in Task manager. Sus and Web hosting service stopped and dllhost.exe went down to reasonable memory usage |
| Momo | Consumes CPU resources to almost 100% but seems to do nothing. Must kill the process to get the server to respond properly again. The process re-spawns almost immediately |
| S. Samad Khokhar | It slows down Interconnection |
| Theobald Kafé | two instances indeed came with "Internet Information Services (IIS)" (win2k here) along with 2 other processes. if you don't want to run a site from your computer (for an intranet for example) uninstall that through the windows-components screen (a tab in software settings) |
| DataFighter | Die dllhost.exe (dynamic link libary) gehört zu Windows -oder zu dessen Server. Die dllhost.exe ist eine Standapplikation für Webserver. |
| demonia987 | It is present since I installed my WEB server |
| Blackbomb | Part of DCOM needed if you want to access various ActiveX controls, can be used as a pathway for viruses, but by itself it isn't |
| Pavithra | while running long ASP scripts,DLL HOST.exe is taking upto 99% CPU |
| | Slow down the system running same time with ''legal'' dllhost.exe (user name = system) |
| Cool Duncan | This is a file which maybe a system file or the virus w32.welchia.worm |
| xor | dllhost.exe is not a virus, it's windows utility for COM. But trojan called Winkiller is replacing this and other files. See also: Link |
| Joe | I am an ASP developer and my PC CPU maxed out by this app. Could this be becuase another developer is running a web application from my machine? The user running was "IWAM_ my_computer_name ". |
| Ryan | With the mentioning of the COM applications, I'm lead to believe that my instance of dllhost.exe was installed with Visual Basic 6.0. I have seen it before, but not before the VB installation. |
 Mr PC Know-It-All | this file is a natural part of windows, but like all programs, it can be used in a manner which would mimic a virus/worm/trojan. however, in normal cases it is relatively safe. |
| Raina Samnani | dllhost.exe a runtime component service, most of the time this process is left in use even if its called application has terminated, users of IIS do not get surprise to see this mostly on use of ASP pages, this process can be manually ended if you are sure it was initiated by of your applications See also: Link |
| Matthew | This program is required access the internet, in order to have a sucessful installation of Microsoft .NET Framework (my ocurrance happened during the installation of version 1.1). Only allow access if downloading from http://www.Microsoft.com or Windows Update. Windows XP SP 1 or SP 2 is required. See also: Link |
| Tirupasuri Nagaraja | This is dynamic link libary and multiple instances runs especially on web servers or servers using IIS effecting the CPU utilisation. Need to kill the instances to bring back the server to normal which doesn't effects the server in any means. |
| | dllhost.exe appears only when I start my b ATI Multimedia Center /b , its a program I use to capture videos. When I turn the ATI program off, the dllhost.exe dissappears. |
| Klown | basicaly jack..... i just wanna know if it being in the prefetch and dllcache means anything other than the obvious......... |
| Tirupasuri Nagaraja | This is dynamic link libary and multiple instances runs effecting th eCPU utilisation |
| B | Cranks up the CPU usage to 100% after uninstalling .NET Framework 2.0 Beta |
| | It's not needed for most systems, better to not have it running at all |
| | Dot Net Framework! War da als ich die 1.1er Version installiert hab! |
| Clarke | zone alarm alerts during install of .NET framework service pack 1.1 |
| | just came out of nowhere, also helpsvc.exe and helpctr.exe |
| Craig Gilchrist | It does exactly what it says on tin!! It's a host process for COM dlls. The is the host process which runs ANY requested DLLs which are registered on your machine. So Yes, this can be used to run a virus (If you unfortunately have one installed and registered and who's functionality is compiled into a DLL), It is also used to run nice friendly DLLs which are shipped with Windows, especially when IIS is installed. In short, it's meant to be used for the powers of good but can become corrupt like an evil pixie and run nasty code. |
| Kellen | This is a very annoying file. It creates adware and neededware popups, but doesn't show them to you. I am pretty sure its trying to install software to the computer. If you delete it manually, another program will keep trying to restore, therefore giving you the unseen popups anyways. It gets very annoying when you are typing and it trys to open an IE program, so it de-selects the program you are using. |
| jeff | As far as I can tell all this is doing to me is a weird prank thing...after i clear my recycle bin it becomes full again, when you try to empty again it says "are you sure you want to delete 'window's?"...chacked and dllhost is the only odd process running, cant seem to get rid of if though |
| dllhost=toast | Came out of nowhere, I look at my processes every day. Could be spyware type of thing. Pissing me off that I cant remove it. Not a part of w32.welch |
| Lloyd Jura | Stop the world wide web publishing service and then restarted it. dllhost.exe CPU usage dropped from 99% down to 4%. |
| Martin | Used for .net programs to connect to databases via ODBC. Server shows the connection coming from dllhost |
| Brett | Runs DLLs, etc within IIS. Runs as service by IWAM_ computer name , unless changed. quite normal. |
| rufus | datei wurde von ms-net. installiert und befindet sich bei mir in window/system/ (win98) |
| Sandesh Pawar | CPU utilization gets high due dll host file |
| franniesings | sudden appearance |
| Ryan | I wonder this a velnerability which hacker can use it. |
| andvalb | Used to execute dll COM inproc servers as exe COM outproc servers. |
| DJ | dllhost.exe is a REQUIRED component of Microsoft Windows, and should not be terminated or deleted. It manages DLL level programs (98% of 32-bit programs). If you terminate dllhost.exe, you will need to hard boot your machine. If you delete it, you will need to reinstall your operating system. Anyone reporting this one as a virus either has no clue what they are talking about or is posting malicious information intentionally. |
| LkS | One file of .net framework only |
| Fixer | People, there is the legit version of this file that is the COM process, and there is a spyware file that uses the same name, located in c:/windows/shelltray. Delete the latter, and delete the corresponding startup registry entry |
| jw | I have zone alarm blocking its access to the internet and have no problem with cpu speed |
| AspCoderMan | This file is used by ASP Server (IIS). It isn't dangerous. |
| m0rpheus88 | Dot Net Framework |
| v!rus | if the file implements or uses functions like CoRegisterSurrogateEx (open the file in some text viewer, like Notepad or WinCmd Lister), then it's COM surrogate thah comes with SP2, IIS and .NET stuff, else it's welchia. Peeking at file contents is good practice anyway, it reveals stuff like what dlls is the app linked to, which functions does it use or provide, etc. |
| deleted_scenes | Appeared after I installed .netAnnoying that I can't shut it off |
| Michael | chrashes my ATI 9700 AIW in TV-Mode everytime |
| Marcus | Well I know everytime you try to delete it it comes back, and my dads PC has it too, so I say its not dangerous. |
| Viper | By some of the responces in this it seems to me that SMTP processes could be viral. Viruses use what they can get their hands on dllhost.exe is one of them. |
| d.s. | Kommt wohl von "Visual Basic 6" (aber nicht reproduzierbar) |
| Rafiuddin.K | dllhost.exe - DCOM DLL host process supports DLL-based COM objects and is used by many Windows programs. .NET Runtime and IIS are probably the two most common applications that use this process.The original file from Microsoft gets placed in the C:\WINDOWS\System32\dllhost.exe directory. if you find it anywhere else then you should be suspicious for sure. |
| MicroLMV | Is a windows file. dllhost.exe = COM Surrogate. Control of diferents instances. See also: Link |
| Lubo999 | This is legal part of windows op.systems,some viruses replace this file but file itself is not virus!!! |
| Sarvesh Damle | This file creates lots of problems while running com+ components. |
| RR | Unless there is a firewall, it is definitely a vulnerability to the security of OS. It can definitely act as a server... Cant its working be modified for good? |
| | also started running out of nowhere on my system, uses resources. using procmon i found weird call stack: ntoskrnl.exe!NtReplyWaitReceivePortEx+0x3e2 |
| E.C | Only shows up when I open the internet browser. |
| Kazroth | As already said it`s a host process for COM dlls. Takes CPU time though but isn`t dangerous as long as not located in "Windows\System32\wins". Killing the process may result in very strange behavior of web servers. |
| Robert Natiello | host process which runs any requested DLLs which are registered on your machine.It is not harmful to terminate the process as stated previously as I do it every week with no repercussions - it aliviates poor mem utilization. |
| Rick | It is the host process for DCOM Applications. The applications in side of DCOM are probably what are causing the problem. We have developed a system that usses over 220 components contained in a DCOM Application. Anytime one of those are utilized it will run inside teh DLLHost process. That being said anyone can develop software to run in DCOM including worms etc. It is no more at fault that the OS itself for any malicious applications that are loaded in to it. |
| ss | disabled this service "COM+ System Application" and dllhost.exe would stop running |
| swamy | This file was added when I installed .NET 1.1 update |
| martin | it starts with i tunes or win media player has to do with accessing wav files |
| anonymous | computer stated acting slow (xp), force quit and 80mb for page memory was freed up and computer returned to norm. task manager did not report hllhost.exe true performance saying it was zero, when it was really almost 100%. Good ole microsoft, pc hasn't been online in months, and years before that. |
| the beast 2 | dllhost.EXE the killer it freezes you the cpu even C'A'D didnt work it was a killer the file an comes in more than 1 way so look for a file closes the the same file as in the frist beast there is a run dllhost file 2 it dose nothing if the frist file is gone |
| k4ngucup | dllhost.exe is a requiered component on COM base application, it will be horirble when the clients connection is poor, i preffered to kill the dllhost.exe process to solves the problem (using my own autokill Process), and it is works, the server does no need to restart but the clients need to reLogin. it is better than waitting for a long restart server. |
| John | Used with Microsoft's Script Editor for Win2K and XP, It is used to run and interface with wscript.exe's DLL's and is needed to run certain programs for databasing such as WinRK. See also: Link |
| Phil Z. | It was never in my computer, but when i download the new windows media player it appeard on the windows task manager {opens with new windows media player 11} |
| Trash | its something like a virus, it starts by playing a huge game or some application, it slows down my computer, so i run task manager and i end it!!! |
| | dllhost.exe is an identity theft grabber! someone knew my credit card number and my paypal account... it hadnt happen before but ever since dllhost.exe was up this has happen... ending the process made it come back the program used was plasma ball! |
| ron | this file was created as an antidote for the blaster virus. The writer was trying to do a good thing but screwed it up. dllhost in windows/system32 is good - if in system32/wins its a bad thing - get symantec removal tool to get rid of it. |
| n00b eater | Began to show up on task manager randomly (never seen it before) Not malicious, but I am wondering why I haven't seen it before. |
| Dan | dllhost.exe came with SP2 for our XP, it seems to load after explorer has closed? It is at least on XP found in the DLLCache, ntservicepack, folders, and in the windows prefetch.folder. I usually rename files that are questionable and see if the systems functions change for the good or bad, Renaming dllhost.exe caused nothing more than not seeing it loaded in task manager. However on a side note one of the biggest problems I have found is multiple copies of Iexplore watch out for these duplicates. The only one needed at least for XP is in program files\Internet Explorer. |
| Fred | Suddenly appeared after installing .Net framework SP1, i've been experiencing slower internet connection like never before. Im uninstalling net framwork now and see if it works. Its funny that dllhost only show up when i installed net framework SP1. Now i uninstalled everything about netframework and dllhost keeps in the taskmanager and if i terminate it, it comes back after 1 sec.crap microsoft!! |
| P. L. | I first find out this thing when I tried to update my Norton Anti-virus, it blocked the access to symantec.com, then when I tried to run some online anti-virus scan, all the websites were blocked. |
| me | Runs for IIS. |
| wotanDT | dllhost.exe tauchte bei mir das erste mal auf nachdem ich mir die englische demo von "Warhammer - Mark Of Chaos"-Demo (engl.) installiert hatte. Musste den Prozess mehrmals beenden bevor er nicht mehr auftauchte. Seit dem nichts mehr davon gemerkt (liegt bei mir in Windows\system32 und Windows\ServicePackFiles\i386 |
| Anonymous | Used for .ASP Scripts running on IIS6 |
| Travis Crincoli | Go to your windows folder and then enter system32 folder. If dllhost is found in this folder, your A-OK! if not, do a search of your computer with spybot S&D or AVG Free. |
| Giridhar | A DLL may it be COM or Ordinary DLL requires that an application that loads it. DLLHost.exe is a general application which can load the COM DLL for use by COM+ Services. |
| | COM+ Event System service, stop and disable it, and it goes away |
| nogi | You can check your list of startup programs, if it is there try deleting it. If you are unable to delete it, it is a virus. It also stops you from launching task manager. |
| wguru | Bit more explantion, "stop" the dllhost.exe service running by going to comp mgmt services COM+ System Application and clicking stop because no dependancies were listed for my current configuration/running system. |
| Nacho | Proceso anfitrión de Microsoft DCOM DLL - dllhost.exe es parte del sistema Microsoft Windows. dllhost.exe gestiona aplicaciones basadas en DLLs. Este proceso es importante para la estabilidad y seguridad del sistema y no debería ser detenido. |
| SMS | Why would this appear in your windows/startup? Is it safe to delete it from that point? |
| Chief5B | executed by Software installers, harmless service ... |
| MakDen the Terminator | As mentioned above, there is a legitimate and there is a malicious file with the same name found in Win 2000 machines in our facility. While Sygate cought its activity right away, I couldn't kill the process from the task manager. Fortunately, Spygate was able to terminate the process and after that I was able to delete the malicious files found by the search option. The malicious version has all caps DLLHOST.EXE so it's easy to recognize. While active, the machines were cloged and worked slower than PC XT from 20 years ago. Good luck. |
| Brian | found file hiding in c:/documentsand settings\All Users\Start Menu\Programs\Startup so therefore would start everytime computer started and hung cpu at 99% would only delete when started in safemode then all was ok again |
| sannysweet | I have two hard disk in my pc both hard disk have operating system, i just boot my pc using the other disk drive operating system , then search for the file dllhost.exe on the infected hard drive from there i deleted that file, then i rebooted my pc using the infected drive there is no more trace of dllhost.exe on my pc. |
| | Happened after upgrade to windows media 11 and urge music |
| pirli | die datei befand sich bei mir im autostart und nicht im windows verzeichnis - legte mein outlook lahm - im inet ging so gut wie gar nichts - nachdem ich die datei umbenannt hatte - lief mein system wieder einwandfrei |
| Lisa | I had some sort of worm, filepath C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dll.exe, which is not legit... if you have this, then see the link.... but yeah, if it's located in System32, then everything's OK. I've also found a dll.exe in my I386 folder. Anybody have any idea whether this is legit or not? Can't find any information whatsoever. See also: Link |
|
|
