How to remove "dll-propagation" virus

Follow these advises at your own risk.

I have been having internet connection problems for a couple of weeks, both in the computer and other devices using the home network. At the same time, computer was running slower than usual. I checked the processes running (taskmgr in the search box) and found a strange process using a lot of resources (you can order them by CPU or by memory usage). This process was called dll-propagation.

I searched this process in Google and found only results in polish forums.

The first step I took was to try to run Windows Defender, but it was disabled and I did not manage to turn it back on. I ran then a couple of online antivirus (ESET and F-Secure) without positive results. I installed then Malware Bytes which did find a file with the virus and delete it. But the virus stayed in the system. Malware Bytes kept popping-up messages that it had blocked the access to the web by 'dll-propagation' but it didn't delete the virus, and it kept appearing in Processes when running the Task Manager.

The thing that worked for me: I identified the two processes by which the virus was running:

    dll-propagation_2.9.8.exe

    dll-propagation.exe

    dllruntime.exe

Windows 10 (and probably previous and newer versions too) has an option to block programs from running. I added then these three exe files in this list. I did this in Windows running in Safe Mode(*).

To add these programs I typed gpedit in the Windows search box and clicked on "Edit group policy".

Then went to: User Configuration -> Administrative templates -> System -> Don't run specified Windows applications

I clicked then in 'Show' and added the three exe files as:

Still in Safe Mode I deleted several folder related to the virus:

I removed EVERYTHING in 'C:\Users\YOUR-USERNAME\AppData\Local\Temp\'

In 'C:\Users\YOUR-USERNAME\AppData\Roaming\', I removed the folders:

    Ookla 

    dll-access 

    dll-propagation 

    dllservices 

    .dllbackups

I also un-installed HandBrake, as it appeared in the log-file from the polish forum where dll-propagation was mentioned, and my problems started at the same time I installed the program. I also uninstalled another program I installed in the same time, just in case.

After all this, I restarted the computer in normal mode.

Finally, I installed CCleaner and cleaned both the system and the registry.

After these steps, dll-propagation has stopped appearing in the Processes when running the Task manager and the pop-ups from Malware Bytes saying it blocked dll-propagation from connecting to the web also stopped. My internet connection works as usual, as well as does the computer.

Update 27.10.2021

In a work computer where I also had to remove dll-propagation, I noticed that it was in the list of start-up processes. Go to the Windows search box and type 'taskmgr' and the sheet 'Startup'. Check if any dllruntime or dll-propagation appear and Disable them.

(*) Start Windows in Safe Mode:

Type msconfig in the Windows search box.

Go to 'Boot'

Click in 'Safe mode' (keep it minimal - you will not have internet connection when you restart, and this 

Click 'Ok'

To restart in normal mode, just go to the same place and disable 'Safe mode'

How I succesfully removed "xml.oceanreefs.xyz"

If your internet browser keeps showing ads (at a higher rate than previously), and you notice that the browser is opening a new window with the address "xml.oceanreefs.xyz" that quickly redirets to something other (like https://www.aliexpress.com/), you have a virus in your computer. They call them sometimes ad-ware but let's face it, something that makes your computer make things you don't want it to make is basicly a virus.

I have opened several pages about "How to remove xml.oceanreefs.xyz" and nothing worked. No antivirus detected it, there was no mention of "xml.oceanreefs.xyz" in the registry or any folder with that name...

But finally I managed to get rid of it. This is how:

The virus has indeed modified the registry, but not using the address "xml.oceanreefs.xyz", but this other:
"cityskyscraper.com"
So this is what you have to look for.

Click on Start and type regedit (or reg.exe).
Once it opens click on Search (Ctrl + F) and type "cityskyscraper.com"

Delete every entry of the registry where this address is mentioned.

Just in case, you can search for "xml.oceanreefs.xyz" and delete any entry mentioning it (but in my case there was none with this address).

Messing with the registry is dangerous, so you want to be sure that you do not delete anything else.


I also made a second step afterwards to be completely sure, I scanned my PC with Malwarebytes (there is a free version).
So if cleaning the registry was not enough, you can try to scan your computer with Malwarebytes.