Windows 7: dllhost.exe - many instances and consuming all CPU/RAM?!

Sir George · 20 Oct 2013

Quote: Originally Posted by liustephen

Hi,

I've googled and tried many suggestions, but not making any progress.

I've noted in the past few days/weeks, my computer is running MUCH more slowly. Lagging, etc. Opened up Task Manager, and noticed dllhost.exe - about 10-15 times listed, and with constant memory consumption. At times, CPU usage up to 100% and Phys memory up to 80% (with NO other programs running!).

My laptop is pretty "clean" - I use it for work when I travel, so it really only has document files on it.

I've run multiple anti-virus on it (Windows Essentials, Malaware, ESET), without nothing significant found.

I've scanned the disk for errors, I've optimized, I've cleaned out/deleted files (through Windows), without change.

I don't have any video files on the desktop (really, no video files that I can find anywhere).

I have noticed that if I have the wifi turned OFF, then dllhost never shows up in the TaskManager. As soon as I turn the wifi ON, then dllhost.exe starts popping up (listed about 10-15 times) and CPU/memory consumption goes up. If I then turn wifi OFF, then the CPU usage drops back down to 5% or so.... but the dllhost.exe stays listed in TaskManager, and Physical Memory usage remains high. As soon as I turn wifi back on, then the CPU usage starts going up again.

Any thoughts out there?

Thanks,
Stephen

I would check for malware using the tool provided at the following link;

http://www.malwarebytes.org/products/chameleon/

HTH

liustephen · 20 Oct 2013

To answer some questions. On the 1 pic that I (suboptimally) posted, all of the dllhost.exe's were pointing to different websites (I had firefox opened for the moment, but I don't use any of those search engines that the dllhost.exe's were referencing. And they still were running even with firefox closed).

Well.... I'm not sure what happened now.

Everything seems to work fine now. No changes made by me.

Though, my MS Secur Essentials seemed to have just picked up a virus and cleaned them. Interestingly, I had run MS Security Essentials MANY times already (along with malaware, ccleaner, spybot) when this problem surfaced, but never anything picked up until now). This is what the log states was cleaned:

VirTool:Win32/Obfuscator.PN
VirTool:Win32/Obfuscator.PN
VirTool:Win32/Obfuscator.PN

(three times).

Hopefully this helps some other out there.

Thank you all for the tips- Process Monitor and Process Explorer are cool programs to see what's really going on with the computer.

Thanks,
Stephen

UsernameIssues · 20 Oct 2013

There are types of infections that will not be detected by Microsoft Security Essentials or Malwarebytes. Sometimes these infections bring in other infections (which sometimes do get detected by MSE scans). These hidden infections are best detected by scanners like Kaspersky's Rescue Disk and Windows Defender Offline (WDO). If your computer can boot to a USB flash drive, the you can easily use that with WDO.

Let us know if those scans find anything.

Sir George · 21 Oct 2013

Quote: Originally Posted by liustephen

To answer some questions. On the 1 pic that I (suboptimally) posted, all of the dllhost.exe's were pointing to different websites (I had firefox opened for the moment, but I don't use any of those search engines that the dllhost.exe's were referencing. And they still were running even with firefox closed).

Well.... I'm not sure what happened now.

Everything seems to work fine now. No changes made by me.

Though, my MS Secur Essentials seemed to have just picked up a virus and cleaned them. Interestingly, I had run MS Security Essentials MANY times already (along with malaware, ccleaner, spybot) when this problem surfaced, but never anything picked up until now). This is what the log states was cleaned:

VirTool:Win32/Obfuscator.PN
VirTool:Win32/Obfuscator.PN
VirTool:Win32/Obfuscator.PN

(three times).

Hopefully this helps some other out there.

Thank you all for the tips- Process Monitor and Process Explorer are cool programs to see what's really going on with the computer.

Thanks,
Stephen

This is just an FYI, MSSE has experienced a substanial drop in testing results lately and it may be a good idea to look for a replacement. See the article located at the following link;

Goodbye Microsoft Security Essentials: Microsoft Now Recommends You Use a Third-Party Antivirus

LukeIsBack · 21 Oct 2013

I suggest, turning off all services except Windows, and safe boot with internet, and if it still be a problem, then try safe boot without internet and then check. If there wont be a problem anymore, when you will narrow suggestion list...

UsernameIssues · 21 Oct 2013

Quote: Originally Posted by Sir George

~~~
This is just an FYI, MSSE has experienced a substanial drop in testing results lately and it may be a good idea to look for a replacement. See the article located at the following link;

Goodbye Microsoft Security Essentials: Microsoft Now Recommends You Use a Third-Party Antivirus

True, but see this thread too as to why some are sticking with MSE: MSE worries
Maybe the OP can suffer thru to the end of that long thread.

sfmitch · 12 Jun 2014

I am having the same problem the OP described with the only difference that I'm using a wired ethernet connection.

I get a bunch (10 to 15) dllhost.exe *.32 instances running and machine slows down.

If I don't have ethernet connected when I boot, then machine runs fine.

I have ran MalwareBytes, AVG, Kaspersky TDDS and MS Security Essentials. The machine was infected and a number of Trojans, etc. were removed.

If anyone has any info on how to fix this, please let me know.

bitkahuna · 24 Aug 2014

just dealt with this on a client's computer. not an optimal solution, but this is how i dealt with.

punch line: created a new user account, logged in with that, scanned, cleaned, all clean, etc. then deleted the old account after saving any client docs/pics, etc.

couple of notes:
1) before deleting their old account, IF i logged in with it (after having done above) the dllhost.exe processes begin to rack up again, so they were somehow buried in that account, which is why i decided to kill it with fire.

2) the dllhost.exe account even piled up if i ran in safe mode on the old account.

anyway, so far, so good.

carld · 26 Aug 2014

Hello,

On a Dell OptiPlex 790, updating the Intel NIC driver (through Windows Update - which I normally don't use for driver updates) fixed this problem.

Spent 2+ hours on malware removal attempts prior to stumbling across this fix. Hope it helps someone out there.

Carl