Go Back   Cyber Tech Help Support Forums > Software > Malware Removal

Notices

Reply
 
Topic Tools
  #1  
Old November 9th, 2018, 04:09 AM
kuzzz's Avatar
kuzzz kuzzz is offline
CTH Subscriber
 
Join Date: May 2003
O/S: Windows 7 64-bit
Location: california
Posts: 1,500
File using up massive amounts of memory- Moved by MURF

I've noticed my machine running real slow and when I look in processes I find this file using up gobs of memory. dllhost.exe COM Surrogate. When I stop the process my machine is back to normal but it keeps coming back. Do you know anything about this file and how to get rid of it permanently?

Thanks
kuzzz
Reply With Quote


  #2  
Old November 9th, 2018, 08:21 AM
smurfy's Avatar
smurfy smurfy is offline
Cyber Tech Help Moderator
 
Join Date: Sep 2000
O/S: Linux
Location: Christchurch New Zealand
Posts: 9,504
This is (usually) a pretty important Windows process that allows other applications to run properly.
It is likely a 3rd party app is causing the excessive memory use, but in order to diagnose which one, Microsoft task manager alone isn't up to the job.
Resource monitor may help but ideally you should use Process Explorer which can be downloaded for free from Microsoft here.

It could also be a case of a malware infection, but let's consider the more benign first before referring you to malware removal.
Reply With Quote
  #3  
Old November 11th, 2018, 01:53 AM
kuzzz's Avatar
kuzzz kuzzz is offline
CTH Subscriber
 
Join Date: May 2003
O/S: Windows 7 64-bit
Location: california
Posts: 1,500
I have downloaded Process Explorer I'm not sure how to use it. I found the file dllhost.exe but I don't know how to find out what app is using it.

kuzzz
Reply With Quote
  #4  
Old November 12th, 2018, 01:25 AM
smurfy's Avatar
smurfy smurfy is offline
Cyber Tech Help Moderator
 
Join Date: Sep 2000
O/S: Linux
Location: Christchurch New Zealand
Posts: 9,504
My PE view is somewhat customised but you should be able to find the dllhost.exe process(es) in the tree and hover your mouse over it as shown below.
Use View>Select columns to add more informative details on memory and commandline if you need to.
Make sure the lower pane is set to show DLL in the view menu.

In my case, I can see it is Windows Thumbnail Cache dll running (but obviously not causing any issues).
Attached Images
File Type: jpg dllhost_in_ProcessExplorer.jpg (464.2 KB, 6 views)
Reply With Quote
  #5  
Old November 13th, 2018, 03:04 AM
kuzzz's Avatar
kuzzz kuzzz is offline
CTH Subscriber
 
Join Date: May 2003
O/S: Windows 7 64-bit
Location: california
Posts: 1,500
Mine show 2 instances of it
dllhost.exe dllhost.exe 2,788 K 7,692 K 3996 C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{30D49246-D217-465F-B00B-AC9DDD652EB7} COM Surrogate Microsoft Corporation

dllhost.exe dllhost.exe < 0.01 6,848 K 9,708 K 4056 C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{3EB3C877-1F16-487C-9050-104DBCD66683} COM Surrogate Microsoft Corporation

But it still doesn't tell me why it would be using up so much memory and slowing down my pc to almost a stand still.

kuzzz
Reply With Quote
  #6  
Old November 13th, 2018, 03:37 AM
Murf's Avatar
Murf Murf is offline
Moderator
 
Join Date: Oct 2001
O/S: Windows 10 Home
Location: Newport News VA
Age: 73
Posts: 17,036
May be related. Change the folder view from "medium icons" to list, or whatever icon view you have. The problem may be missing thumbnails and Windows is trying to recreate them (unsuccessfully), which can really slow a pc down.

But maybe a virus that has infected the dllhost.exe file. Let me move this over to our malware forum, not many folks left but maybe they can at least see if your system is clean.

I will PM them and let them know.
Reply With Quote
  #7  
Old November 13th, 2018, 04:56 PM
olgun52's Avatar
olgun52 olgun52 is offline
Malware Removal Team
 
Join Date: Feb 2014
O/S: Windows 10 Pro
Location: Europa
Posts: 1,964
Hello kuzzz.

Could you please send Farbar scan logs. Let's check.


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Have a nice day.

Reply With Quote
Reply

Bookmarks

Topic Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump




All times are GMT +1. The time now is 04:22 PM.