Hello all. Thank you in advance for all of the help you provide us "technically challenged."

I am having the same type of problem as many other users: When I try to start and run regedit or taskmgr it says its already in use by another program

My ctrl+alt+delete is disabled. I notice a program is always running in the background called dllhost.exe. I also noticed that this application is embedded in a Start Menu for all user on my computer. I am not able to delete this as is says it is in use.

I have already tried to use the removal process and cleaning software listed in a sticky at the top of this board. I thought it would solve everything but I am still having the same problems.

Any help is greatly appreciated.

Attached Files

	ComboFix.txt (14.6 KB, 1 views)
	adaware results.TXT (14.8 KB, 0 views)
	VBG.TXT (1.3 KB, 0 views)
	rapport.txt (1.2 KB, 0 views)
	HJT.txt (7.2 KB, 1 views)

[B]Hello and welcome to Techspot.[/B]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

[b]Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT).[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial61.html"]HERE[/URL].

[b]In Windows Explorer, turn on "Show all files and folders, including hidden and system".[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial62.html"]HERE[/URL].

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

p2p networking

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

p2pnetworking.exe
dllhost.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe

O4 - Global Startup: dllhost.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following [b]bold[/b] files and/or directories(if there).

[b]p2pnetworking.exe[/b]<Search your system for this file and delete all instances found.

Do a search of your system for the dllhost.exe file and let me know the full filepath to all instances of it you find. [b]Do not delete it.[/b]

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log as well as an AVG Antispyware log.

Regards Howard

[color=red][b]This thread is for the use of[/color] Goat [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

Howard -

I followed your instructions.
The path to dllhost.exe is C:\WINDOWS\system32

Attached are the HJT and AVG post clean logs....

Looks like everything is gone. BTW I found some 1000 WinZip files hidden in my documents folder, each containing a file named video.exe. This may have been the source file. I guess the files were waiting to be downloaded by Emule or Limewire users to spread the darn thing.

thanks again for your help!

- Goat

Attached Files

	HJT-postclean.txt (8.9 KB, 1 views)
	AVG Report-Scan-20070318-205354 post clean.txt (508 Bytes, 1 views)

Your HJT log is clean.

The filepath you have given for the dllhost.exe file is legit, so just leave it be.

[b]Turn off system restore.(XP/ME only)[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial56.html"]HERE[/URL].

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

[color=red][b]This thread is for the use of[/color] Goat [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]