Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

DLLhost oddities


  • Please log in to reply
2 replies to this topic

#1 dudemang

dudemang

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:35 PM

Posted 13 March 2013 - 09:57 PM

Just today I noticed that my computer kept repetitively running and terminating - almost cyclically - a dllhost process.

 

Doing some digging with Process Explorer from Sysinternals, I noticed it was part of the Dcomlaunch svchost process. Tracing the GUID the /ProcessId flag sends to DLLhost, it seems linked to the WinInetBrokerServer DCOM Component Service, which I can't find anything specific on, but is apparently part of Windows.

 

While this process is doing its thing, I notice there's a steady, small burst of outbound traffic (not too large, usually around 90-200 B) detected by COMODO firewall every few seconds. Suspending the process in Process Explorer before it self-terminates and respawns stops this traffic.

 

I don't know what to make of it. Neither MalwareBytes nor MSE pick up anything being updated to their latest definitions, nothing seems out of place in a HiJackThis log, Spybot 2 doesn't see anything out of the ordinary, and I only received one alert from COMODO which may have just been a misclick on my part. It doesn't seem malicious (it's not impacted any performance on my computer), but it just makes me jittery. I did just recently do a Windows Update, so was that perhaps a change in how Windows does things?



BC AdBot (Login to Remove)

 


#2 vs777

vs777

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:35 PM

Posted 14 March 2013 - 10:21 AM

I have the exact same issue that you detailed, I found your post after trying to google what dllhost.exe is doing.  I noticed this started yesterday (May 13/2013) after I installed a bunch of Windows Updates: KB890830, KB2807986, KB2791765 and Internet Explorer 10.  KB2809289 (IE 9 security patch) failed to install, because IE 10 was installed as part of the group of updates. So I don't know if that failed update has anything to do with it. 
 
Either way this is/was driving me nuts (an .exe opening and closing over and over), so I tried uninstalling IE10.  Rebooted and... yeah, no more dllhost.exe opening and closing anymore.  Its not even running anymore after a momentary blip on my last reboot after uninstalling IE10.  I don't really use IE anyway, but I installed it as a group of updates.
 
Did you also install IE10?  


#3 dudemang

dudemang
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:35 PM

Posted 14 March 2013 - 03:30 PM

I did, and I followed your advice, and that seems to have done the trick! I don't use IE much, either (if I have to, I usually do so within Firefox with the IE Tab Plus add-on), but I usually try to keep it updated, if only because it'll hopefully make it that much harder to exploit. I'm somewhat wary about having to fall back on IE9 for the moment, but I'll just have to do some more research, I suppose.

 

Thanks for the help! :)






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users