Solved Dllhost.exe accessing ad/malware sites

[William Clemens]

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: rsinger
->Temp folder emptied: 18605 bytes
->Temporary Internet Files folder emptied: 19303480 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 844 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 18.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: rsinger
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Public

User: rsinger
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 10142013_203121
Files\Folders moved on Reboot...
C:\Users\rsinger\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\rsinger\AppData\Local\Temp\JavaDeployReg.log moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UVLX27KI\ads[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UVLX27KI\like[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UVLX27KI\postmessageRelay[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UVLX27KI\push[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8676QL07\fastbutton[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8676QL07\page-2[2].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UNZH1QY\follow_button[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UNZH1QY\prefetch[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UNZH1QY\push[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UNZH1QY\zrt_lookup[1].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2FX4GQG8\dref=http%253A%252F%252Fwww.techspot.com%252Fcommunity%252Ftopics%252Fdllhost-exe-accessing-ad-malware-sites[2].htm moved successfully.
C:\Users\rsinger\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

 

[William Clemens]

THANK YOU!
I have worked through most of the checklist, just finishing up updating a couple more programs: Adobe Reader XI (Secunia says it needs update even though I downloaded supposedly the latest version from your link) and Skype.

One other issue I still have is that I cannot install virus database for eset. I am inclined to uninstall and reinstall eset NOD32 Antivirus unless you recommend otherwise. The update downloads and completes 16 of 19 steps then ends with an unspecified error.

 

[William Clemens]

I have removed and reinstalled Eset NOD32 Antivirus and successfully downloaded the latest virus database.

 

[William Clemens]

Eset smart scan was clean and computer seems to be running fine. All Windows updates completed. Although MySearchDial, Conduit, and Babylon were cleaned during the whole cleaning process, there are still some registry entries for MySearchDial and Babylon. Do I need to be concerned about this? I can provide registry entry details upon request.

 

[William Clemens]

Here are the registry keys containing references to either MySearchDial or Babylon:
Keys containing MySearchDial:
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\mysearchdial
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\mysearchdial\mysearchdial
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-489157004-3444769675-352332829-1000\Software\mysearchdial
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-489157004-3444769675-352332829-1000\Software\mysearchdial\mysearchdial
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-489157004-3444769675-352332829-1000\Software\mysearchdial\mysearchdial\iestrg
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\mysearchdial
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000_Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\mysearchdial\mysearchdial
Keys containing Babylon:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
HKEY_USERS\S-1-5-21-489157004-3444769675-352332829-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted

 

[Broni]

You can delete those keys if you wish (create new restore point first) but it's up to you.
Since none of those adwares are present as active it's not really important.

 

[William Clemens]

I won't mess with the registry if they're not doing any harm. Thank you!

 

[Broni]

You're very welcome