Решена Почему запускается dllhost.exe

DllPok

Активный пользователь

perfmon /res Связанные модулы

Образ ИД Имя модуля Полный путь
dllhost.exe 1552 sqmapi.dll C:\Program Files\Internet Explorer\sqmapi.dll
dllhost.exe 1552 ADVAPI32.dll C:\Windows\system32\ADVAPI32.dll
dllhost.exe 1552 api-ms-win-core-synch-l1-2-0.DLL C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL
dllhost.exe 1552 api-ms-win-downlevel-advapi32-l1-1-0.dll C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
dllhost.exe 1552 api-ms-win-downlevel-advapi32-l2-1-0.dll C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
dllhost.exe 1552 api-ms-win-downlevel-normaliz-l1-1-0.dll C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
dllhost.exe 1552 api-ms-win-downlevel-ole32-l1-1-0.dll C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
dllhost.exe 1552 api-ms-win-downlevel-shlwapi-l1-1-0.dll C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
dllhost.exe 1552 api-ms-win-downlevel-user32-l1-1-0.dll C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
dllhost.exe 1552 api-ms-win-downlevel-version-l1-1-0.dll C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
dllhost.exe 1552 CLBCatQ.DLL C:\Windows\system32\CLBCatQ.DLL
dllhost.exe 1552 CRYPTBASE.dll C:\Windows\system32\CRYPTBASE.dll
dllhost.exe 1552 CRYPTSP.dll C:\Windows\system32\CRYPTSP.dll
dllhost.exe 1552 DllHost.exe C:\Windows\system32\DllHost.exe
dllhost.exe 1552 ESENT.dll C:\Windows\system32\ESENT.dll
dllhost.exe 1552 fltlib.dll C:\Windows\system32\fltlib.dll
dllhost.exe 1552 GDI32.dll C:\Windows\system32\GDI32.dll
dllhost.exe 1552 guard64.dll C:\Windows\system32\guard64.dll
dllhost.exe 1552 iertutil.dll 11 C:\Windows\system32\iertutil.dll
dllhost.exe 1552 IMM32.DLL C:\Windows\system32\IMM32.DLL
dllhost.exe 1552 kernel32.dll C:\Windows\system32\kernel32.dll
dllhost.exe 1552 KERNELBASE.dll C:\Windows\system32\KERNELBASE.dll
dllhost.exe 1552 LPK.dll C:\Windows\system32\LPK.dll
dllhost.exe 1552 MSCTF.dll C:\Windows\system32\MSCTF.dll
dllhost.exe 1552 msvcrt.dll C:\Windows\system32\msvcrt.dll
dllhost.exe 1552 normaliz.DLL C:\Windows\system32\normaliz.DLL
dllhost.exe 1552 ntdll.dll C:\Windows\SYSTEM32\ntdll.dll
dllhost.exe 1552 ole32.dll C:\Windows\system32\ole32.dll
dllhost.exe 1552 OLEAUT32.dll C:\Windows\system32\OLEAUT32.dll
dllhost.exe 1552 profapi.dll C:\Windows\system32\profapi.dll
dllhost.exe 1552 psapi.dll C:\Windows\system32\psapi.dll
dllhost.exe 1552 RPCRT4.dll C:\Windows\system32\RPCRT4.dll
dllhost.exe 1552 RpcRtRemote.dll C:\Windows\system32\RpcRtRemote.dll
dllhost.exe 1552 rsaenh.dll C:\Windows\system32\rsaenh.dll
dllhost.exe 1552 sechost.dll C:\Windows\SYSTEM32\sechost.dll
dllhost.exe 1552 SHELL32.dll C:\Windows\system32\SHELL32.dll
dllhost.exe 1552 shlwapi.DLL C:\Windows\system32\shlwapi.DLL
dllhost.exe 1552 USER32.dll C:\Windows\system32\USER32.dll
dllhost.exe 1552 USERENV.dll C:\Windows\system32\USERENV.dll
dllhost.exe 1552 USP10.dll C:\Windows\system32\USP10.dll
dllhost.exe 1552 uxtheme.dll C:\Windows\system32\uxtheme.dll
dllhost.exe 1552 version.dll C:\Windows\system32\version.dll
dllhost.exe 1552 wininet.dll C:\Windows\system32\wininet.dll

вот этот появляется и создает кэш в папке AppData\Local\Microsoft\Windows\WebCache хотя отключег сам IE в компонентах виндовс .

What is guard64.dll?

guard64.dll is part of COMODO Internet Security and developed by COMODO according to the guard64.dll version information.

guard64.dll’s description is «COMODO Internet Security«

guard64.dll is digitally signed by Comodo Security Solutions, Inc..

guard64.dll is usually located in the ‘C:\Windows\system32\’ folder.

None of the anti-virus scanners at VirusTotal reports anything malicious about guard64.dll.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on guard64.dll:

Property	Value
Product name	COMODO Internet Security
Company name	COMODO
File description	COMODO Internet Security
Legal copyright	2005-2010 COMODO. All rights reserved.
Product version	4, 1, 149672, 916
File version	4, 1, 149672, 916

Here’s a screenshot of the file properties when displayed by Windows Explorer:

Product name	COMODO Internet Security
Company name	COMODO
File description	COMODO Internet Security
Legal copyright	2005-2010 COMODO. All rights reserved.
Product version	4, 1, 149672, 916
File version	4, 1, 149672, 916

Digital signatures [?]

guard64.dll has a valid digital signature.

Property	Value
Signer name	Comodo Security Solutions, Inc.
Certificate issuer name	VeriSign Class 3 Code Signing 2009-2 CA
Certificate serial number	2c01585522e8fa61138aefa4f627eea8

VirusTotal report

None of the 43 anti-virus programs at VirusTotal detected the guard64.dll file.

Hashes [?]

Property	Value
MD5	84dac08dd9a7c11d687b86560379a45e
SHA256	29730aeda82000bbdd401aca8f82be9d79999b11cd8e93671ed354a829d11260

What will you do with guard64.dll?

To help other users, please let us know what you will do with guard64.dll:

What did other users do?

The poll result listed below shows what users chose to do with guard64.dll. 26% have voted for removal. Based on votes from 31 users.

NOTE: Please do not use this poll as the only source of input to determine what you will do with guard64.dll.

Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

And now some shameless self promotion 😉

Hi, my name is Roger Karlsson. I’ve been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you’ve identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.

If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer’s scan result or just want to say hello, please contact me. You can find my email address at the contact page.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I’m reading all new comments so don’t hesitate to post a question about the file. If I don’t have the answer perhaps another user can help you.

Judy Zedalis writes

Love your website and your help at fighting hackers. I have comodo firewall and have had no problems with it. I will keep this file.

Windows system32 guard64 dll

Domanda

Salve a tutti. Possiedo un pc portatile toshiba con windows 7 64bit, antivirus Microsoft security essentials e come firewall COMODO. Guardando nel visualizzatore eventi ho notato che dal 12 gennaio mi esce un avviso con scritto : «Le librerie di collegamento dinamico personalizzate vengono caricate per ogni applicazione. L’amministratore del sistema dovrebbe esaminare l’elenco delle librerie per accertarsi che siano correlate ad applicazioni attendibili.»

Risposte

disable Defense+
Deactivate Defense+ Permanently

Ovvero Disabilta Defense+ permanentemente

Se hai un sistema a 32 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Se hai un sistema a 64 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Rinomina l’estensione del file da .txt a .reg

Importa il file reg facendoci doppio click sopra

Riavvia il computer

• Contrassegnato come risposta Vincenzo Di Russo MVP, Moderator martedì 8 febbraio 2011 17:22

Tutte le risposte

guard64.dll è utilizzata da Defense+ di Comodo e utilizza un AppInit Hook che potrebbe essere la causa del problema. Prova a vedere la soluzione proposta in questo thread dei forum di COMODO:
http://forums.comodo.com/empty-t57562.0.html

guard64.dll è utilizzata da Defense+ di Comodo e utilizza un AppInit Hook che potrebbe essere la causa del problema. Prova a vedere la soluzione proposta in questo thread dei forum di COMODO:
http://forums.comodo.com/empty-t57562.0.html

disable Defense+
Deactivate Defense+ Permanently

Ovvero Disabilta Defense+ permanentemente

Se hai un sistema a 32 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Se hai un sistema a 64 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Rinomina l’estensione del file da .txt a .reg

Importa il file reg facendoci doppio click sopra

Riavvia il computer

• Contrassegnato come risposta Vincenzo Di Russo MVP, Moderator martedì 8 febbraio 2011 17:22

disable Defense+
Deactivate Defense+ Permanently

Ovvero Disabilta Defense+ permanentemente

Se hai un sistema a 32 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Se hai un sistema a 64 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Rinomina l’estensione del file da .txt a .reg

Importa il file reg facendoci doppio click sopra

Windows system32 guard64 dll

Вопрос

Salve a tutti. Possiedo un pc portatile toshiba con windows 7 64bit, antivirus Microsoft security essentials e come firewall COMODO. Guardando nel visualizzatore eventi ho notato che dal 12 gennaio mi esce un avviso con scritto : «Le librerie di collegamento dinamico personalizzate vengono caricate per ogni applicazione. L’amministratore del sistema dovrebbe esaminare l’elenco delle librerie per accertarsi che siano correlate ad applicazioni attendibili.»

Ответы

disable Defense+
Deactivate Defense+ Permanently

Ovvero Disabilta Defense+ permanentemente

Se hai un sistema a 32 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Se hai un sistema a 64 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Rinomina l’estensione del file da .txt a .reg

Importa il file reg facendoci doppio click sopra

Riavvia il computer

• Помечено в качестве ответа Vincenzo Di Russo MVP, Moderator 8 февраля 2011 г. 17:22

Все ответы

guard64.dll è utilizzata da Defense+ di Comodo e utilizza un AppInit Hook che potrebbe essere la causa del problema. Prova a vedere la soluzione proposta in questo thread dei forum di COMODO:
http://forums.comodo.com/empty-t57562.0.html

guard64.dll è utilizzata da Defense+ di Comodo e utilizza un AppInit Hook che potrebbe essere la causa del problema. Prova a vedere la soluzione proposta in questo thread dei forum di COMODO:
http://forums.comodo.com/empty-t57562.0.html

disable Defense+
Deactivate Defense+ Permanently

Ovvero Disabilta Defense+ permanentemente

Se hai un sistema a 32 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Se hai un sistema a 64 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Rinomina l’estensione del file da .txt a .reg

Importa il file reg facendoci doppio click sopra

Riavvia il computer

• Помечено в качестве ответа Vincenzo Di Russo MVP, Moderator 8 февраля 2011 г. 17:22

disable Defense+
Deactivate Defense+ Permanently

Ovvero Disabilta Defense+ permanentemente

Se hai un sistema a 32 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Se hai un sistema a 64 bit crea un file di testo con il seguente contenuto

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
«AppInit_DLLs»=»»
«LoadAppInit_DLLs»=dword:00000000

Rinomina l’estensione del file da .txt a .reg

Importa il file reg facendoci doppio click sopra