Windows – Cleaning up a compromised Windows 7 laptop

I see on my computer dllhost.exe running from C:\Windows\System32, while yours is running from C:\Windows\SysWOW64, which looks somewhat suspicious. But the problem can still be caused by some 32-bit product installed on your computer.
Check also the Event Viewer and post here any suspicious messages.

My guess is that you are infected or that Windows has become very unstable.

The first step is to see whether the problem arrives when booting into Safe mode. If it doesn't arrive there, then the problem is (maybe) with some installed product.

If the problem does arrive in Safe mode, then the problem is with Windows. Try running sfc /scannow to verify system integrity.

If no problems are found, scan using :

• AdwCleaner
• ComboFix

If nothing helps, try a boot-time antivirus such as :

• Dr.Web
• F-Secure
• Panda

To avoid burning real CDs, use Windows 7 USB DVD Download Tool to install the ISOs one-by-one on a USB key to boot from.

If all fails and you do suspect an infection, the safest solution is to format the disk and reinstall Windows, but try all other possibilities first.

Check DNS settings on the router, modem and other devices. Also consider a factory reset, rather than just a reboot - the reset will completely clear all settings.

If you are using default (ISP-assigned) DNS servers, consider changing them to an alternative, such as Google's 8.8.8.8 - if you observe this behaviour stopping, consider checking with other users of this ISP, or reporting the issue to them. It's possible (though unlikely) that your ISP was compromised. There's also the possibility that malware on your computer itself was designed to attempt common passwords on consumer routers and make this change, though that is unlikely.

Another potential attack vector is a vulnerability in the router software itself. Unfortunately, it's not easy to detect such an attack - probably the simplest thing to do is look up the model number and see if there are any known vulnerabilities. If any exist, then you should either update the firmware (if possible) or replace it with a different device.