Video Screencast Help

dllhost.exe Consuming All Physical Memory

Created: 04 Apr 2013 | 5 comments

I recently noticed that occasionally my CPU meter started reading that my RAM was at 90% and higher. At this point obviously my computer is running slower than mollases. Come to find out after little digging When I open th windows task manager i have a "dllhost.exe" file that is in the millions. So I did some research and come to find out dllhost.exe is a natural .exe file that runs in windows. But nowhere does it say that its supposed to be in the millions of kb. So i took caution when ending the process. As soon as i ended it my computer started running perfectly normal again. But it just keeps restarting itself so often. 

I am pretty sure i have a virus but Symantec isnt finding im sure because of the fact that its hiding itself under a file thats supposed to be there. If anybody could help or has any advice that would be greatly appreciated.

Operating Systems:

Comments 5 CommentsJump to latest comment

Rafeeq's picture

Make sure you have latest virus definitions

Boot the machine in safe mode

then run a full scan.

Check if you find anything suspicious in registry.

 

Common loading points for viruses, worms, and Trojan horse programs on Windows 2000/XP/2003

 

http://www.symantec.com/business/support/index?page=content&id=TECH99331

 

Edit: Aditionally run this tool

http://www.symantec.com/security_response/writeup.jsp?docid=2003-081819-3333-99

.Brian's picture

You may also want to run Symantec Power Eraser on this machine. It is possible that a virus injected itself into a legitimate Windows process.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Chetan Savade's picture

HI,

Make sure all the SEP featuers are installed, OS is full patched and having latest service pack.

Use Power Eraser to detect threat and remove them

http://www.symantec.com/theme.jsp?themeid=spe-user...

You might have to submit suspicious files to the Symantec for further analysis if issue persist.

Using Symantec Help (SymHelp) Tool, how do we Collect the Suspicious Files in SEP 12.1  and Submit the same to Symantec Security Response Team.

https://www-secure.symantec.com/connect/articles/u...

Symantec Help (SymHelp)

http://www.symantec.com/docs/TECH170752

Best Practices for Troubleshooting Viruses on a Network

http://www.symantec.com/docs/TECH122466

 

Chetan Savade
Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

la_ripper's picture

It could be possible that there is a malicious file hooked onto dllhost.exe.

The best way to find out would be to run the process explorer to determine what is running under dllhost.exe

If anything suspicious sumit it to Security response and if not then you may need to open a ticket wid MS to investigate.

 

 

Don't forget to mark your thread as 'solved'  or vote with the answer that best helped you!
 

Chetan Savade's picture

Hi,

Do you have any update on this?

Chetan Savade
Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<