11

I have multiple dllhost.exe processes running on my Windows 7 computer: enter image description here

Every one of these image's command line is missing (what I am thinking is) the requisite /ProcessID:{000000000-0000-0000-0000-0000000000000} command line option: enter image description here

Question: How can I determine what's actually running in this process?

It's my belief that if I can identify the actual application doing the work inside these dllhost.exe processes I'll be able to determine if my system is infected or not (see below).


Why I'm Asking/What I've Tried:

These DLLHOST.EXE instances look suspicious to me. For example, several of them have a lot of open TCP/IP connections:

enter image description here

Process Monitor shows and absurd amount of activity. Just one of these processes generated 124,390 events in under 3 minutes. To make matters worse, several of these dllhost.exe processes are writing approximately 280 MB of data per minute to the user's TEMP and Temporary Internet Files folders in the form of folders and files with random four character names. Some of these are in use and cannot be deleted. Here's a filtered sample:

enter image description here

I know this is probably malicious. Unfortunately, blasting the system from orbit must only be done after exhausting all other options. To that point, I've done:

  1. Malwarebytes full scan
  2. Microsoft Security Essentials full scan
  3. Thoroughly reviewed Autoruns and submitted files I don't recognize to VirusTotal.com
  4. Thoroughly reviewed HijackThis
  5. TDSSKiller scan
  6. Reviewed this SuperUser question
  7. Followed these instructions: How To Determine Which Application Is Running Within a COM+ or Transaction Server Package
  8. For each of the DLLHOST.EXE processes, I've reviewed the DLLs and Handles view in Process Explorer for any .exe, .dll or other application-type files for anything suspicious. Everything checked out though.
  9. Ran ESET Online scanner
  10. Ran Microsoft Safety Scanner
  11. Booted to Safe Mode. The command switch-less dllhost.exe instance is still running.

And aside from a few minor adware detections, nothing malicious is popping up!


Update 1
<<Removed as irrelevant>>

Update 2
Results of SFC /SCANNOW: enter image description here

  • 1
    ask this Gov Maharaj from Microsoft via the posted emai, so that he can answer this in his show: channel9.msdn.com/Shows/The-Defrag-Show – magicandre1981 Oct 31 '14 at 8:09
  • @harrymc Mine shows 7/13/2009 and 7168 bytes. File version 6.1.7600.16385. – I say Reinstate Monica Nov 5 '14 at 19:49
  • If your Windows is 64-bit then I would guess that the problem is coming from a 32-bit installed product. – harrymc Nov 5 '14 at 20:08
  • What's on the strings tab? Anything interesting? – Jon Marnock Nov 10 '14 at 5:01
  • Could be worthwhile to know what of services the dllhost.exe process makes use of? Start from command line wmic path Win32_Service Where "ProcessId = 28420" – JosefZ Nov 10 '14 at 9:31
2
+50

I see on my computer dllhost.exe running from C:\Windows\System32, while yours is running from C:\Windows\SysWOW64, which looks somewhat suspicious. But the problem can still be caused by some 32-bit product installed on your computer.
Check also the Event Viewer and post here any suspicious messages.

My guess is that you are infected or that Windows has become very unstable.

The first step is to see whether the problem arrives when booting into Safe mode. If it doesn't arrive there, then the problem is (maybe) with some installed product.

If the problem does arrive in Safe mode, then the problem is with Windows. Try running sfc /scannow to verify system integrity.

If no problems are found, scan using :

If nothing helps, try a boot-time antivirus such as :

To avoid burning real CDs, use Windows 7 USB DVD Download Tool to install the ISOs one-by-one on a USB key to boot from.

If all fails and you do suspect an infection, the safest solution is to format the disk and reinstall Windows, but try all other possibilities first.

  • There are some steps here I'll begin trying. The machine is well-maintained and has been stable until this behavior showed up (we were alerted to the problem by 10 GB of temp files written in a few days' time). I think the file being in \SysWOW64 is OK as I've confirmed the same file exists on other Win7 machines. – I say Reinstate Monica Nov 5 '14 at 20:05
  • 1
    If you suspect an installed startup product, Autoruns is a handy utility for turning them off in bunches and then back on again, rebooting each time. – harrymc Nov 5 '14 at 20:10
  • I've repeatedly and extensively examined the Autoruns entries and found nothing suspicious. What gets me is this behavior showed up out of the blue. – I say Reinstate Monica Nov 5 '14 at 20:13
  • What did you find in the 10GB Temp folder? – harrymc Nov 5 '14 at 20:13
  • 1
    @kinokijuf: Thanks for leaving a comment justifying the downvote. To my defense I note that this is the accepted answer, since an antivirus I recommended found the infection when many others failed. – harrymc Nov 12 '14 at 8:20
6

It's a Fileless, Memory-Injecting, DLL Trojan!

The credit for pointing me in the right direction goes to @harrymc so I've awarded him the answer flag & bounty.

As far as I can tell, a proper instance of DLLHOST.EXE always has the /ProcessID: switch. These processes don't because they're executing a .DLL that has been injected directly into memory by the Poweliks trojan.

According to this writeup:

...[Poweliks] is stored in an encrypted registry value, and loaded at boot time by a RUN key calling rundll32 process on an encrypted JavaScript payload.

Once [the] payload [is] loaded in rundll32, it tries to execute an embedded PowerShell script in interactive mode (no UI). That PowerShell scripts contains a base64-encoded payload (another one) which will be injected into a dllhost process (the persistent item), which will be zombified and act as a trojan downloader for other infections.

As noted in at the beginning of the above-referenced article, recent variants (mine included) no longer start from an entry in the HKEY_CURRENT_USER\...\RUN key but are instead hidden in a hijacked CLSID key. And to make it even harder to detect there are no files written to disk, only these Registry entries.

Indeed (thanks to harrymc's suggestion) I found the trojan by doing the following:

  1. Boot to Safe Mode
  2. Use Process Explorer to suspend all of the rouge dllhost.exe processes
  3. Run a ComboFix scan

In my case the Poweliks trojan was hiding in the HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} key (which is has to do with the Thumbnail Cache). Apparently when this key is accessed it executes the trojan. Since thumbnails are used a lot this had the effect of the trojan coming to life almost as quickly as if it had an actual RUN entry in the Registry.

For some additional technical details, see this TrendMicro blog post.

-1

If you want to do these kind of forensic analyst of running processes, services, network connection, ... I recommend you to use also ESET SysInspector. It gives you better view about running files, also you can see not only dllhost.exe, but files linked with argument for this file, path for auto startup programs, ... Some of them may be services, it also take their names, you see it in nice colorized application.

One big advance is that it also give you AV results for all files listed in log, so if you have infected system, there is a big chance to find a source. You can also post here xml log and we can check it. Of course, SysInspector is part of ESET AV in Tools tab.

  • I installed and ran ESET SysInspector but it's not telling me anything Process Explorer and Process Monitor haven't told me so far, although I do like how SysInspector makes some of this information easier to access. – I say Reinstate Monica Oct 30 '14 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.