You may be infected with Poweliks
(aka Gootkit, a Poweliks clone) which typically affects the ability to browse or download files using Internet Explorer and causes PowerShell error alerts. Task Manager typically shows numerous occurrences of (COM Surrogate) dllhost.exe
. If using a 64-bit version of Windows, then these entries will be listed as dllhost.exe *32
or dllhst3g.exe *32
. These processes are known to spawn and consume a large amount of system resources. When attempting to download files in Internet Explorer you may receive the message "Your current security settings do not allow this file to be downloaded.
" or you may see a pop-up alert advising that "powershell (powershell.exe) has stopped working
If you are having trouble downloading files with Internet Explorer, follow these instructions
to re-enable downloads/reset all Security zones to default.