• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

My Windows 7 laptop started giving me a lot of trouble. It began running slower and slower, and multiple instances of dllhost*32.exe began filling the task manager. I tried ending the processes, but they kept multiplying. Eventually, the computer locked up, so I rebooted it in safe mode, and installed Norton security on it. Norton cleared out a whole bunch of malware, which freed up my computer, but the dllhost*32.exe problem still remains. Furthermore, it only affects my computer once it's online. Offline, the problem goes away. Every time I log into my computer, I get error messages from this program called "powershell." I also get the little Norton window saying that Norton blocked an attack by a Trojan.Poweliks virus. A few days ago, I left it online accidentally, and I got a message from Norton saying that it detected, a "suspicious amount of outbound traffic". It told me to run Norton Power Eraser, which apparently did nothing. From what I've read, I think Poweliks uses powershell to run a script that starts multiple instances of dllhost*32.exe, and I don't think Norton is stopping the infection, regardless of the little popup window that I get. If anyone could help, that would be greatly appreciated.

Replies

Kudos2 Stats

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Hi Stinger, You are requested to work with a free malware removal forum listed at : https://community.norton.com/forums/malware-removal-forum-recommendations . . . . . . . Please do not try anything of yourown. Since this is an open forum, assisting to cleanup malware is very difficult here.
regards, CV | There is no ONE TOUCH KEY to security . Be alert and vigilant. . | Always have a Backup Plan!
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Will do, thanks!

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Hello,

I too had this and have solved it. 

First, I would like to point out that even if a software tool removes it such as the latest version of RogueKiller, it comes back upon rebooting, so there is a manual intervention as well.  I will provide you with the steps.

First, after downloading RogueKiller, reboot without internet\wifi.  If you leave that on your computer will be very slow. Then run RougeKiller.  When it is finished, if you scroll to the bottom of the registry tab, you will see that it has found Poweliks. DO NOT DELETE! Instead, right the path of the virus down. IT will be located in your registry. So open up Regedit from the Run Program prompt (regedit.exe). Then follow the path that RogueKiller tells you. Once you have located the offending Registry Key, DO NOT DELETE IT. Instead, edit it, and remove the first couple of lines of code, just mess that code up so it cannot run. Now save, and reboot. VOILA.

Kudos5 Stats

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

If it were only that easy.i would definitely follow Nikhil_CV recommendations and visit one of the free malware removal forums.You should not be attempting a fix yourself and definitely not offering flawed advice.I would urge you visit one of the free sites like Quads removal forum,and follow all directions to the letter and do not deviate.Poweliks is quite tricky and should not be toyed with by anyone other than a trained expert.

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

The utility ComboFix completely cleans, neutralizes and fixes Poweliks.  I have used it on three different computers.  Now if I could get my users to stop opening rogue MS Word documents.

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

I'm going to look into Combofix, but I signed on to this forum so I could share what I have learned about this.  I personally have yet to find a solution and I do my own IT but I'm not a trained pro.  Searching for this sucker brings up a lot of people looking for a solution and lots of misinformation.  The assumption is that this is only one Trojan but I'm not sure that is a valid assumption.  Things I have found:  Microsoft has a way to write encrypted entries into the registry to protect Windows source code.  This can't be edited in regedit because regedit only sees ASCII.  This thing is using that process so it isn't ascii and you won't find it with regedit.  Dllhost is a swiss army knife file that all sorts of processes call to do all sorts of things.  It's not the dllhost file itself, it's the registry entry that calls it.  Deleting dllhost won't do any good and will probably screw your system.  I AM going to look into combofix but other than that I have found nobody who knows how to kill this thing.  I have used all the biggies, all the suggestions, and gone into the registry myself, which I'm familiar with, and nothing has worked.  I ran Microsoft's antispy (forget which one - the deep scanner) all last night thinking hey, they wrote the OS.  Well, it found some stuff like all the others and then there are 25 dllhosts right after a reboot.  I don't know, it's just frustrating that apparently the computer security industry has so far been bested by the writers of this thing.  I'm going to keep looking but I gotta say I haven't found anybody, anywhere who actually knows how to kill it.  I reiterate - the things about the registry and such above are what I've learned in this research, not my opinions.

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Hi, Jdon. Not entirely true. Some sites have been able to fix this malware. EG

http://qmalwareremoval.freeforums.net/board/2/malware-removal-protected

Windows 10 Home X 64
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

John,

When I first encountered the virus the PC was protected (barely) by MS Security Essentials.  I removed that and installed the full paid versions of ESET NOD32 Antivirus (not Smart Security) version 8 AND Malwarebytes.  Once installed the computer continuously produced popups in the bottom right hand corner from Malwarebytes and ESET.  This showed that the attempts by the virus to contact external websites were being blocked.  Now I had the virus caged.  After that I tried a battery of 8 different utilities to remove Powerliks.  The ONLY one that was able to remove it entirely was the free utility ComboFix downloaded from bleepingcomputer.  I also found this a very frustrating experience and it took me 3 days to completely remove the virus.  Subsiquently I have run into two more computers (at two different client sites) that were infected and I was able to treat them identically.  I first only suggested ComboFix because this is a Norton forum and I don't want to come off as a shill for competing products in the marketplace.

By now I hope you have been successful in removing the virus.  If I can be helpful please let me know.

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Thanks to both replies.  I want to say that I joined this forum to try to be helpful, not to argue or point fingers at anyone here or elsewhere.  I found this by searching for symptoms and I find that every forum like this has hundreds of people doing the same thing, many if not most less tech sophisticated than some.  A couple of months ago I downloaded some games from CNet for my brother, who has no internet.  I also installed a couple for myself, which I never actually played.  I suspect I caught this from that, but the point being that CNet proudly claims to be malware free, and the real point being that apparently none of the big name malware vendors seem to have a handle on this thing.  That's their job, that's what people are paying them for.  Again, not finger pointing, just "hey, come on guys.........."  I'll add two symptoms that I have found - again, I'm posting this stuff for the Google searchers who find this, mostly.  One another writer reported too - we use IE11 with tabs, and a new tab has panes with our browsing history on it.  For awhile there were these sites that we never visited that were called "very active".  That's the Trojan browsing, not us/you.  The other is that last week I booted up in the morning and got windows saying that downloads weren't permitted because of my security settings - like 10 of them in a row.  This is the scary part, that I wasn't downloading anything and what about the folks with lower security settings.........  This is a business computer and I have a business to run, so little by little I keep working on solving this but I can't spend all day on it - it's still in there as of now but it's relatively benign for the time being. 

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

I had a personal mail which I replied to.  In doing so I went back to a Microsoft page/forum I wanted to reference, just 20 minutes ago.  This morning there were a few new posts, one of which links to Eset's Poweliks removal tool.  I gave it a shot, it took all of 20 seconds, rebooted and I have no symptoms so far, since then.  I actually seemed to work.  Check it out, I'll link to the forum:

http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/i-would-like-to-remove-trojan-virus-poweliks/24a0e04e-8056-4ffd-b38a-ecf46fd5b76d?auth=1

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Norton has released its own removal tool, which can be obtained from http://www.symantec.com/security_response/writeup.jsp?docid=2014-111020-... and manual removal procedures (not much appreciated unless you know it) from : http://www.symantec.com/security_response/writeup.jsp?docid=2014-080511-...
regards, CV | There is no ONE TOUCH KEY to security . Be alert and vigilant. . | Always have a Backup Plan!
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Nikhil_CV:
Norton has released its own removal tool, which can be obtained from http://www.symantec.com/security_response/writeup.jsp?docid=2014-111020-... and manual removal procedures (not much appreciated unless you know it) from : http://www.symantec.com/security_response/writeup.jsp?docid=2014-080511-...

CV, please note that with a Norton tech remotely accessing a user's machine it still took 7 hours!

https://community.norton.com/comment/6036071#comment-6036071

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Thanks for heads up, Dave... :-)) Well, thats not a big time to clean a machine to clean a malware of powliks! Type. I think that employee was interested in helping the user more than just removing the infection(s) ( which makes him stand out of crowd ) . I did not have an intention to appreciate the self fix tools but to mark a point that Norton / Symantec has released the fix tool . Sorry if my message was misleading .
regards, CV | There is no ONE TOUCH KEY to security . Be alert and vigilant. . | Always have a Backup Plan!
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

The problem is that Poweliks isn't always alone, so even if the tool can clean Poweliks there is no guarantee the machine will be clean.  I still stand by my instuctions;

Firstly, please do NOT try any quick 'fixes' or to solve this yourself.

It sounds like it's time to sign up for assistance from one of the free malware removal sites.  Please pick one and stay with them until your system is clean.

https://community.norton.com/forums/malware-removal-forum-recommendations

Cheers,
Dave

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Hi, Krusty.  While I'm the first to agree with you that anyone with this infection should go to one of the free malware removal forums, it makes me wonder what use this tool is, if we can't be sure a machine is now clean.

I'll still be directing people to the removal forums.

Windows 10 Home X 64
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

fredrixdsouza:

Automatic Removal Tool is capable to remove all kind of harmful threats including trojan infection from compromised computer and also provides security to it.

for more info, please visit :

Do so at your own risk.

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Thank you, thank you, thank you John.  Husband called repair man and I decided to try your solution before he arrived.  Figured I had nothing to lose and although hubby disagreed with what I was doing, together we managed a repair.  Computer working better than ever now............Repairman cancelled!

Again thanks..........hey everybody, this really works.

Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

Had same problem this morning...ran anti malware in safe mode..all still there....simply did system restore ..then ran it again and all is back to normal
Kudos0

Re: Trojan Poweliks Virus Causing Multiple Dllhost*32 Processes and Powershell Errors On Windows 7

I had good luck with Malwarebytes Anti-Rootkit.  It seemed to get everything cleaned out the first time. 

This thread is closed from further comment. Please visit the forum to start a new thread.