It is possible that you are close. winhost32.exe is indeed part of adware and it is a downloader, so it is responsible for reinstalling all the stupid stuff every time you delete it.

You might be home free if you delete this file. It should be located in your Windows folder, inside the "System32" folder if you are on XP or the "System" folder if you are in Windows95 or 98.

It might not let you delete the file, because it is a running process. If that is the case, open your task manager (control-alt-delete all at the same time) Make sure you press control-alt-delete only once or else it will reboot your computer. In the Task Manager, click on the tab that says "Processes". (gee there's a lot of crap that runs just to get Windows up and running, eh? ) Look for "winhost32" in the list (this list you can sort alphabetically by clicking on the header of the "name" column). From what I read there are supposed to be two showing as running. Don't worry if you see only one or more than two... we are going to stop them all.

Click once on any entry that says "winhost32" to select it, then hit the "end process" button. If there are more copies, end them all, one at a time. When you are done close the task manager.

Now go back to the file and try to delete it. (I like to give it a few seconds to make sure the process is really stopped). Hopefully it should delete.

One of the reports I found said that winhost32 is in two locations... so just to be safe, do a file search for "winhost", make sure "check system and hidden files" is checked in the options, and run the search. If it pulls up any copies of winhost3.exe or winhost.anything-else delete them (you can delete right from the results in the search box.)

Reboot and maybe everything will be ok.. I don't know if those dlls are called from winhost32, if so they should stop. If they still appear there may still be something else loading from the registry that we have to locate and stop.

------------------------------------
--http://www.idexter.com