cihost.exe - Dangerous
cihost.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
When Trojan.Linst is executed, it does the following:
Creates the following files in the current folder, %Windir% and %System32%:
Zlib.dll: A legitimate library file
Groups.txt: A configuration file
Links.txt: A configuration file
HttpReq.dll: A legitimate library file
Dlinsth.dll: Detected as Trojan.Linst
Dlinst0.dll: Detected as Trojan.Linst
Bho.dll: An adware detected as Adware.IEHelperPage
Adds the value:
"cihost.exe"="%windir%\cihost.exe"
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the Trojan runs when you start Windows.
Loads the adware - Bho.dll.
Loads Dlinsth.dll that passes information back to http:/ /x-fuck.net, including:
- Software installed
- Environment variables
- System settings
Depending on the results returned by the Web server, advertisements may be displayed.
Use RegRun Startup Optimizer to remove it from startup.