Fake COM Surrogate is keeping on coming back.

It sounds like you're dealing with a persistent malware issue that disguises itself as a COM Surrogate. Here are some steps you can take to address the problem:

1. Run a Full Antivirus Scan: Ensure your antivirus software is up to date and perform a full system scan to detect and remove any malicious software.
2. Use Malware Removal Tools: Consider using specialized malware removal tools like Malwarebytes or Windows Defender Offline to scan and remove stubborn malware.
3. Check Startup Programs: Use the Task Manager to check for any suspicious programs that start with Windows. Disable any that look unfamiliar or suspicious.
4. Delete Suspicious Files: Navigate to the directory mentioned (C:\Users\Ahmed\AppData\Roaming\Dll) and manually delete the suspicious file dlI.host. Ensure that you have hidden files visible in your folder options.
5. Check Registry Entries: Sometimes malware creates registry entries to persist. Use regedit to check for any entries that reference the suspicious file and remove them. Be cautious when editing the registry, as incorrect changes can cause system issues.
6. Reset Web Browsers: If the malware has affected your web browsers, reset them to their default settings to remove any unwanted extensions or changes.
7. Reinstall Windows: If the problem persists and you cannot remove the malware, consider backing up your data and performing a clean installation of Windows.
8. Seek Professional Help: If you are not comfortable performing these steps, consider seeking help from a professional technician.

Make sure to back up important data before making significant changes to your system.

References:

• Microsoft Security Bulletin MS07-027 - Critical
• Microsoft Security Bulletin MS07-033 - Critical

1

Please provide a screenshot of where you are seeing that COM Surrogate entry listed on your system.

2

Click the link below to download a small free utility that does not require installation.

https://download.sysinternals.com/files/Autoruns.zip

When the file downloads, unzip it.

Run Autoruns64 as Administrator

A

Select the 'Logon' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.

B

Select the 'Scheduled Tasks' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.