cancel
Showing results for 
Search instead for 
Did you mean: 
sandyb
Level 7

Taken over by malware or being nused by spammers or advertisers?

For the last week, I have had something on my PC. I have run multiple scans, full and limited, to find something but no luck. I am current with Macafee and Windows, both automatic updates. Symptoms are High newtwork and disk usage tracked by Task Manager, Multiple dllhost.exe processes running, up to 19, when deleted they regenerate. I have run scans in safe mode and tried to download Stinger in safe mode and but I get a dialog box that says security settings do not allow downloads. I have tried to load Microsoft Security on stick and load it but same message.

Any ideas?

0 Kudos
8 Replies
exbrit
Level 21

Re: Taken over by malware or being nused by spammers or advertisers?

Moved to Malware Discussions > Home User Assistance.

Can you boot into Safe Mode and from there initiate System Restore?

If you don't know how to do that I need to know more details, operating system, service pack if applicable and if it is totally up to date including ALL browsers and add-ons.

Aslo do you have a System Disk or Recovery Partition if the worst comes to the worst and we have to format?

0 Kudos
sandyb
Level 7

Re: Taken over by malware or being nused by spammers or advertisers?

Thanks for the response. I can bring up safe mode but the only version to restore is Nov 4th backup and I think the problem was before that.

I have Windows 7/Home Edition build 7601: Service Pack 1. IE is version 10. All under Windows Updates automatic.

I will boot up in regular mode and try to build a system Disk. Earlier I brought up Safe Mode with Networking and the system would not allow Stinger to be downloaded.

0 Kudos
exbrit
Level 21

Re: Taken over by malware or being nused by spammers or advertisers?

See the last link in my signature beloow, especially the Chameleon method of downloading Malwarebytes Free - it's a good tool for finding nasties.

To keep it free simply do NOT accept the free trial.

0 Kudos
sandyb
Level 7

Re: Taken over by malware or being nused by spammers or advertisers?

Thanks, I will try. Incidently, I have everything I need backed up on a USB linked disk.

0 Kudos
sandyb
Level 7

Re: Taken over by malware or being nused by spammers or advertisers?

Using Chameleon blocked with the "security settings do not allow" message.

0 Kudos
exbrit
Level 21

Re: Taken over by malware or being nused by spammers or advertisers?

I have no idea about that, MalwareBytes Forum would know.  The link is in my link I think.

0 Kudos
Hayton
Level 17

Re: Taken over by malware or being nused by spammers or advertisers?

It certainly looks like a malware infection, but I'll confine myself here to the download problem.

The message "Your current security settings do not allow this file to be downloaded" is an Internet Explorer message, but it has also been noted in Firefox. Possibly malware has changed some of the IE security settings.

Open IE, and click through to Tools/Internet Options/Security/ Custom Level.

Change this IE setting, if it's set to 'Disable', to 'Prompt'.  See if that makes a difference.

IE Security settings.PNG

The multiple dllhost entries are often a sign of malware infection. High network and disk usage is worrying because it implies that something is reading data from or writing data to your disk via the internet. One recent example of this was caused by a Java exploit, so if you've got Java installed I advise you to uninstall it as soon as possible. But being able to download anti-malware programs comes first. Let us know if you try this and it doesn't work; you may need specialist assistance.

0 Kudos
sandyb
Level 7

Re: Taken over by malware or being nused by spammers or advertisers?

Thanks for the information. I did change a setting allowing files and was able to download Stinger. Ran it and found nothing.

I am currently running a Mcafee full scan since Mcafee updated this morning. I will redo the Stinger download and run again after changing that specific IE setting.

I have kept the Firewall setting  for Traffic shutdown which seems to keep the activity at a low level. The disk activity of Task Manager shows lots of my files involved although looking at some of the files have not seem damage.

0 Kudos