dllhost.exe - many instances and consuming all CPU/RAM?!

[liustephen]

Hi,

I've googled and tried many suggestions, but not making any progress.

I've noted in the past few days/weeks, my computer is running MUCH more slowly. Lagging, etc. Opened up Task Manager, and noticed dllhost.exe - about 10-15 times listed, and with constant memory consumption. At times, CPU usage up to 100% and Phys memory up to 80% (with NO other programs running!).

My laptop is pretty "clean" - I use it for work when I travel, so it really only has document files on it.

I've run multiple anti-virus on it (Windows Essentials, Malaware, ESET), without nothing significant found.

I've scanned the disk for errors, I've optimized, I've cleaned out/deleted files (through Windows), without change.

I don't have any video files on the desktop (really, no video files that I can find anywhere).

I have noticed that if I have the wifi turned OFF, then dllhost never shows up in the TaskManager. As soon as I turn the wifi ON, then dllhost.exe starts popping up (listed about 10-15 times) and CPU/memory consumption goes up. If I then turn wifi OFF, then the CPU usage drops back down to 5% or so.... but the dllhost.exe stays listed in TaskManager, and Physical Memory usage remains high. As soon as I turn wifi back on, then the CPU usage starts going up again.

Any thoughts out there?

Thanks,
Stephen

 

[logicearth]

Well dllhost.exe just hosts DLLs. It is clear your Wifi driver has something to do with it.

 

[andrew129260]

IF you would please fill out your system specs it will help us help you better.

You can try updating your wifi/netwokring driver.

http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

 

[liustephen]

Thanks. I will update my sys info.

I've just updated my wifi driver - no change.
I don't think that it's that though....

My computer seems to be repeatedly accessing the internet.

Using CCleaner, I "clean" the system and delete "Internet Explorer - Temporary Internet Files", and then "Internet Explorer - Cookies" (+ a whole bunch of others). As soon as all of this i deleted, I re-scan, and those two "options" appear immediately, with a bunch of files. And the number of them steadily climb, every few seconds.

Also, when I use ProcessMonitor, there's a TON of entires all involving Reg Keys...
And then there will be several that appear to be accessing various internet sites (no apparent pattern to me).

Ex: TCP Receive series9-PC.gateway.2wire.nett:50516->cdn-68-142-79-70.lax.llnw.net:http

and then

...........................50521->a23-72-94-200.deploy.static.akamaitechnologies.com:http

etc

between these, there's lots of writing to temp files, and UDP send, UDP receives, and RegQueryKey, etc.

Very intermittently, I also get a "internet explorer-like box" that pops up that asks "do you want to end process".

BUT.... during all of this, I've got NOTHING ELSE running.

It almost seems like there is an instance of Internet Explorer running in the background where I don't see anything. But it is repeatedly accessing the internet (and using up CPU and memory).

In the time that it took me to type this, CCleaner shows 2500 Internet Explorer Temp Internet files (all new, since I deleted them all just before I started this post!).

Thanks for your help,
Stephen

 

[andrew129260]

Try a clean boot.

See here: http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

 

[Layback Bear]

You could take a look in msconfic/Startup and NON Micorosoft Services and see if
you have something running calling home.

 

[UsernameIssues]

.......I have noticed that if I have the wifi turned OFF, then dllhost never shows up in the TaskManager. As soon as I turn the wifi ON, then dllhost.exe starts popping up (listed about 10-15 times) and CPU/memory consumption goes up.......

Welcome to the Seven Forums.

Feel free to ignore this post. It is just the result of my curiosity.

If you have the time/interest...
...I would like to know if those dllhost.exe processes start when you do this:

Remove/delete every Wireless Network Connection* - including the one for your home.
Turn off Wi-Fi
Restart the computer
Let things settle down for 5 minutes
Turn on Wi-Fi
Do the same 10 to 15 copies of dllhost.exe appear in Task Manager?

*Start
Control Panel
Network and Internet
Network and Sharing Center
Manage wireless networks
Right click on each entry and select Remove network from the context menu.


You have excellent people involved in your thread, so I'll leave you in their very capable hands.

 

[liustephen]

Hi,

I tried the "clean boot" option.
It didn't work.

Even with "clean boot", dllhost.exe starts populating my task list until about 10-15 listed.

Will work on the UsernameIssues' idea tomorrow.

Thanks,
Stephen

 

[Layback Bear]

liustephen did you or did you not look in msconfig as I suggested in post #6?

 

[liustephen]

Hi-
I looked at MSConfig. I didn't see anything too unusual that I could find.
When you say "calling home", did you mean like a program accessing the internet?

 

[Layback Bear]

Yes calling home is when things in your boot that startup and access the Internet
to give information or receive information from what ever site or program that installed them.
If you notice in the pictures in my post #6 their are very few check marks.
Their is a reason for that. The other things don't need to start until I or Windows 7 request them to.
This may help in the understanding.
Take a read through #6 and #7

By Brink:
http://www.sevenforums.com/tutorials/11728-optimize-windows-7-a.html

 

[liustephen]

LaybackBear,

So, I've "disabled" all of the Services in the box.
So, do I now enable them one by one and re-start the computer with them enabled to see which one is spawning all of my dllhost's?

 

[andrew129260]

Test the issue for a day with the services disabled. If the problem does not stay, and you restarted a few times and nothing; Then it must be some program on your pc running a service causing the issue. Yes I would re-enable them one by one, starting with your AV (if that was disabled) and then continue from there. Monitor each one turned on for a day or a few hours and do a couple restarts. If issue does not happen go to the next one until you discover the issue.

 

[liustephen]

ok, will do.

what is AV?

 

[UsernameIssues]

AV = antivirus

 

[Layback Bear]

A reminder!!
Do not mess with Windows 7 Services only Non Windows Services should be tested.

 

[xunile]

I had a customer this week with a similar problem, turmed out to be a rather nasty piece of spyware that had gotten by their antivirus, combofix, mbam, and spybot. My suggestion would be to download the program Process Explorer and run it. I will provide a link below. Once you have it running, hover over one of the dllhost entries listed in the program and a info box will pop up where it will show what called the dllhost, it will say something like " command line:" the c:\... etc.

I'll post a screenshot of what it should look like.

Here is the link to Process Explorer: Process Explorer

If you could post a screenshot of what file it shows is spawning the dllhost process we might be able to figure out how to stop it.

 

[liustephen]

Here's the pic from process explorer. It does look like virus? Or some hidden program repeatedly accessing internet for spam. let me see if attaching this photo worked....

View attachment dllhostpic.docx

 

[xunile]

Thanks for posting the screenshot. I would use another program to save the screenshot next time, like microsoft Paint and save it as a jpg. Then when you attach it to your post it will show up inline.

If you could, try hovering over a few of the other dllhost instances, the one you chose seems to be for the instance of Firefox you have open and on the duckduckgo search engine. Look for one where you see something like c:\users\... in the commandline part of the popup at the top.

 

[UsernameIssues]

It is unusual to have that many dllhost instances showing up under explorer (or anywhere else). It seems like one or more infections might be at work. You might want to upload that screenshot via this method:
http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html