TechSpot

ishost.exe problems

By flm74
Aug 14, 2006
  1. I am having issues with some ishost.exe programs. I have run the tools suggested by others here and I am now listing my HJT log, any help would be greatly appreciated.
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Download and run these three tools. Follow the instructions for using each tool.

    Tool1 Tool2 Tool3

    Post a fresh HJT log into this thread, only after doing the above.

    Regards Howard :wave: :wave:

    This thread is for the use of flm74 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. flm74

    flm74 TS Rookie Topic Starter

    The log above was done after those were run. Tool 2 would not run for me, it kept locking up my system.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    s?rvices.exe This not the same as the services.exe file which is legit. The question mark can be any random letter or number. It should be under your user name and not system.

    javaw.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R3 - URLSearchHook: (no name) - {FC49BAA7-0936-21BC-13A2-05F2C97342B7} - C:\WINDOWS\system32\laocddd.dll

    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

    O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)

    O4 - HKCU\..\Run: [Sen] "C:\WINDOWS\RACLE~1\javaw.exe" -vt yazr

    O4 - HKCU\..\Run: [Fpxvvt] C:\Program Files\Common Files\s?stem32\s?rvices.exe

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\WINDOWS\RACLE~1\javaw.exe
    C:\Program Files\Common Files\s?stem32\s?rvices.exe
    C:\WINDOWS\system32\laocddd.dll

    Reboot into normal mode and turn system restore back on.

    Post a fresh HJT log.

    Regards Howard :)
     
  5. flm74

    flm74 TS Rookie Topic Starter

    Ok, done and done. Here is the fresh HJT.log.
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    MyWaySA\SrchAsDe

    Close control panel.

    Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

    R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\MyWaySA

    Reboot your computer and post a fresh HJT log.

    Regards Howard :)
     
  7. flm74

    flm74 TS Rookie Topic Starter

    Thanks so much for your help so far Howard, here is the latest HJT.log.
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is now clean.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of flm74 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. flm74

    flm74 TS Rookie Topic Starter

    I can't thank you enough man, really, you guys provide a great service to those in need.
     
  10. flm74

    flm74 TS Rookie Topic Starter

    Ok, having some new problems. Whenever I try to open a folder or access "my computer" all of my desktop icons vanish.
     
  11. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Post a fresh HJT log and I`ll check to see if it`s clean or not.

    Regards Howard :)
     
  12. flm74

    flm74 TS Rookie Topic Starter

    I can't even open up my computer or even run a search to get to hjt, everything vanishes when i try. going to try booting into safe mode and see what happens.
     
  13. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You might want to try the last known good config option, instead of safe mode.

    Regards Howard :)
     
  14. flm74

    flm74 TS Rookie Topic Starter

    Reposted log, the one above was inaccurate.
     
  15. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is still clean.

    Try doing a Windows repair as per this thread HERE. It may help.

    Regards Howard :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...