Messagehi Chris, the file is located at \winnt\system32. and the size is 5.76 KB. i've scan for the virus, but found nothing. so if this dllhost.exe is really windows program, i think it safe to run. nothing to worried. i also have patch the rpc dcom. many thank's for your help. rgds, hery ----- Original Message ----- From: Chris Adams To: [ExchangeList] Sent: Monday, September 01, 2003 21:20 PM Subject: [exchangelist] RE: strange dllhost and email http://www.MSExchange.org/ The "normal" DLLHOST.EXE application usually sits in <SYSTEM DRIVE>:\WINNT\System32 and is roughly 6k. The "Infected" DLLHOST.EXE from Nachi et al. is in <SYSTEM DRIVE>:\WINNT\System32\Wins\ and is about 10k. DLLHOST.EXE is used to run COM+ components. You may want to check the location and size of your DLLHOST.EXE file to see if you're infected or not. Chris.