-=PCTechTalk=- Re: DLLHOST.EXE And W32 Welsher.
- From: "Jeff Ross" <jross@xxxxxxxxxxxxxxxxxxx>
- To: <pctechtalk@xxxxxxxxxxxxx>
- Date: Wed, 22 Oct 2003 17:48:27 -0500
That's pretty wild.
----- Original Message -----
From: "Barry Toner" <barrys.groups@xxxxxxxxxxxx>
To: "Dj Paddy" <barrys.groups@xxxxxxxxxxxx>
Sent: Wednesday, October 22, 2003 5:37 PM
Subject: -=PCTechTalk=- DLLHOST.EXE And W32 Welsher.
> Hiyas.
>
> I rang my ISP tonight on a different problem. However, they are not
letting
> any xp or 2k customers passed to tech support unless they do a test for
> Welsher and Blaster and confirm they have the XP Hot Fixes KB24 and up.
>
> So it seemed because I had dllhost.exe in my currently running processes
> that I had Welsher.
>
> So I downloaded the Symantec fix for it and ran it.
>
> It gave me,
>
> The service "RpcPatch" is viral. It is deleted.
>
> The service "RpcTftpd" is viral. It is deleted.
>
> The file "C:\WINDOWS\System32\wins\svchost.exe" is deleted.
>
> W32.Welchia.Worm has been successfully removed
> from your computer!
>
> Here is the report:
>
> The total number of the scanned files: 69206
> The number of deleted files: 1
> The number of repaired files: 0
> The number of viral processes terminated: 0
> The number of viral services deleted: 2
> The number of registry entries fixed: 0
>
> Ok so I rebooted and checked the processes and it wa back in there!
>
> So I rang my ISP and they said nope nope it couldnt' be. I managed to
> calmly convinced them it was still running.
>
> So are they saying that dllhost.exe shouldnt' be running at all?
>
> When I ran the Welsher fix again it came up with,
>
> W32.Welchia.Worm has not been found on your computer.
>
> And yet the dllhost.exe is still in processes.
>
> So I put dllhost.exe into google and came up with the following.
>
> dllhost - dllhost.exe - Process Information
>
> Process File: dllhost or dllhost.exe
> Process Name: DCOM DLL Host Process
> Description: The DCOM DLL Host process supports DLL based COM objects and
is
> used by many Windows programs
> Common Errors: N/A
> System Process: Yes
>
> Taken from:
> http://www.liutilities.com/products/wintaskspro/processlibrary/dllhost/
>
> So I'm presuming this is a safe file?
>
> I mean it sounds like this handles my dll's?
>
> Shoudl I rang my ISP and inform of this?
>
> I mean if they are not going to deal with anyone untill dllhost.exe isnt'
> running, wha?
>
> I'm completely confuddled.
>
>
>
> Cheers
> Barry
> I'm small, humble, but have fun.
>
>
> To unsub or change your email settings:
> //www.freelists.org/webpage/pctechtalk
>
> To access our Archives:
> http://groups.yahoo.com/group/PCTechTalk/messages/
> //www.freelists.org/archives/pctechtalk/
>
> For more info:
> //www.freelists.org/cgi-bin/list?list_id=pctechtalk
>
To unsub or change your email settings:
//www.freelists.org/webpage/pctechtalk
To access our Archives:
http://groups.yahoo.com/group/PCTechTalk/messages/
//www.freelists.org/archives/pctechtalk/
For more info:
//www.freelists.org/cgi-bin/list?list_id=pctechtalk
Other related posts:
- » -=PCTechTalk=- Re: DLLHOST.EXE And W32 Welsher.
