Tough I removed it, I do not know what it is: dllhost32 data resources hidden folder

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
Tough I removed it, I do not know what it is.

Have anyone ever seen a virus/spyware  with such things:
Dllhost32.exe
Most exe files have a daemon under hidden subfolder
"\data\resources\", and the size of the daemon is 16KB. The
shortcuts to the exe are changed to pointing to the daemon.

Thus, when I launched a program through short cuts, the daemon will be
launched, and then the daemon launch the original exe.

I am running XP Pro.

As I checked newsgroups about Dllhost32.exe, most posts pointed out
dllhost32 is spyware, but did not explain why there are daemon exe
files and hidden folder. So I am not so sure what my computer got
infected.

I used Spybot, Kaspersky and Adware to check, they all failed to find
anything.

I eventually delete all these 16KB daemon files, and leave those hidden
folder alone, by searching files and deleted. And I wrote a small
program to convert all shortcuts under "Documents and Settings" to
make them point to the original one, by removing string
"\data\resources"

No problem ever since. I suppose I am not the only one getting these.
Just strange enough no one mentioned in news groups. I did search
"dllhost32 data resources hidden".

Can anyone identify what was happing?

Cheers


Re: Tough I removed it, I do not know what it is: dllhost32 data resources hidden folder


| Tough I removed it, I do not know what it is.
|
| Have anyone ever seen a virus/spyware  with such things:
| Dllhost32.exe
| Most exe files have a daemon under hidden subfolder
| "\data\resources\", and the size of the daemon is 16KB. The
| shortcuts to the exe are changed to pointing to the daemon.
|
| Thus, when I launched a program through short cuts, the daemon will be
| launched, and then the daemon launch the original exe.
|
| I am running XP Pro.
|
| As I checked newsgroups about Dllhost32.exe, most posts pointed out
| dllhost32 is spyware, but did not explain why there are daemon exe
| files and hidden folder. So I am not so sure what my computer got
| infected.
|
| I used Spybot, Kaspersky and Adware to check, they all failed to find
| anything.
|
| I eventually delete all these 16KB daemon files, and leave those hidden
| folder alone, by searching files and deleted. And I wrote a small
| program to convert all shortcuts under "Documents and Settings" to
| make them point to the original one, by removing string
| "\data\resources"
|
| No problem ever since. I suppose I am not the only one getting these.
| Just strange enough no one mentioned in news groups. I did search
| "dllhost32 data resources hidden".
|
| Can anyone identify what was happing?
|
| Cheers

Read the following... does its information match what's on your PC ?

http://www.sophos.com/virusinfo/analyses/w32nauticala.html


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Re: Tough I removed it, I do not know what it is: dllhost32 data resources hidden folder

Rebecca2000@gmail.com wrote:
Quoted text here. Click to load it

I am trying to figure out what you're talking about.

Quoted text here. Click to load it

Yeah, Dllhost32.exe host Dll(s) like ProgramName.dll.


Quoted text here. Click to load it

I am still trying to figure out what you're talking about here.

Quoted text here. Click to load it

Dllhost32.exe is a valid NT based MS O/S component if it's running out
of (Windows) for XP or higher and (Winnt) Win 2K or lower NT based
O/S(s), like C:\windows\system32 or c:\Winnt\System32.

If dllhost32.exe is not running out of either one of the folders above
based what O/S is being used, then it's a Trojan that is running and you
needed to get rid of it.

How did you know from what directory was dllhost.exe running out of? And
do you know for sure that whatever Dllhost32.exe you're talking about
was actually running?

Duane :)

Re: Tough I removed it, I do not know what it is: dllhost32 data resources hidden folder


Duane Arnold wrote:
Quoted text here. Click to load it

Thanks, pals. Just how amazing Kaspersky and Spybot and other well
known programs could not spot this out. Luckly there are still pals
knowing this.


Re: Tough I removed it, I do not know what it is: dllhost32 data resources hidden folder

Quoted text here. Click to load it

Oops, I have XP Pro too and the valid one used by the Win XP O/S is
dllhost.exe out of the C:\Windows\System32.

So, if you had some dllhost32.exe that was running, then it was possibly
some kind of malware.

Duane :)

Re: Tough I removed it, I do not know what it is: dllhost32 data resources hidden folder

If you find more info let me know - I had the same infection which I
removed manually -  which sucked.


Rebecca2000@gmail.com wrote:
Quoted text here. Click to load it


Site Timeline