dllHst3g and dllhost

Hi there,

I am running Windows 7 on an acer laptop.

Now, after looking through the task manager, I saw a “dll” pop up and disappear as I was looking through the processes when it appeared and disappeared. Now, I’ve run many tests in the past few days because of a scareware I was dealing with… however, this has got me worried. All of Hitmanpro, tdsskiller, Malware Bytes, and Avast are coming up clean, my quick search on dllhst3g and dllhost are saying it is quite dangerous, and I have a few of them on my laptop as you can see in the screenshot.

Not to mention that my PC is performing about half of its physical usage (but that could be because of avast et al). :-\

So should I delete these files, or no? Is there any other way to check if everything is all right?

https://forum.avast.com/index.php?topic=53253.0

When trying to run aswmrb, I got the blue screen and it would not load to windows properly. Does that mean that something is preventing me from running it? It doesn’t look good. I’m in safe mode and using my phone to use the forum.

Skip aswmbt for now and run Farbar.
attach the logs to your next post.

Here ya go!

Aswmbt seems to hang when I try running it once it gets to c:\users

How long on average should that take?

Sorry for all the questions, I’m just hoping I can get this resolved quickly.

Hello Round-about and welcome to avast!. I will be working on your Malware issues.

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the ‘all clear’ even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper

Although FRST does not say this, it might be a new variant of Powerliks infections know as GootKit or Wonton-KX. We shall start with RogueKillerx64 as it is updated to target this variant.


[*] Please download RogueKiller [free] (by tigzy) on the desktop
[*] Quit all programs
[*] Start RogueKiller.exe.
[*] Wait until Prescan has finished …
[*] Click on Scan. Once finished, click on Delete.

Later you will need to post me the contents of the RKreport.txt in your next Reply.
Notice: RogieKiller might preformt the system reboot.

I had aswmbt run over night before I received your reply. I’ll just upload the file here just in case. Other than that, I’ll be on track with what you need me to do!

Thanks so much for your help! I really appreciate it.

Okay, so I did a roguekiller scan and got this “IAT hooks” once it finished.

That thing in the screenshot is something I cannot remove.

I scanned twice, once with all programs shut down, and again with chrome open just to double check.

But the dllhost and dllhst3g seem to be bypassed from all the scanners…

According to my friend, I got him to check his computer and he says for sure dllhst3g is a Trojan side effect. However, with the scanners, they are not picking any of it up.

Have patience and follow Magma’s guiding.
Please do not change anything on the system.

Ok. Will do.

Hi Round-about,

The problem with “not deleted” occurred because you persistently run aswMBR (which I do not need) and RogueKiller.

Reboot your system again, preform scannign and press Delete (to remove detected items). Then …

Please download Rkill by Grinler from one of the links below and save it to your desktop.

http://www.bleepingcomputer.com/download/rkill/

On Windows XP double-click on the Rkill desktop icon to run the tool.
On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer, you will need to run the application again.

Then, please re-run FRST and post me the both fresh FRST and Addition logreprot for re-analysist