ishost.exe problems

[flm74]

I am having issues with some ishost.exe programs. I have run the tools suggested by others here and I am now listing my HJT log, any help would be greatly appreciated.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Download and run these three tools. Follow the instructions for using each tool.

Tool1 Tool2 Tool3

Post a fresh HJT log into this thread, only after doing the above.

Regards Howard :wave: :wave:

This thread is for the use of flm74 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[flm74]

The log above was done after those were run. Tool 2 would not run for me, it kept locking up my system.

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

s?rvices.exe This not the same as the services.exe file which is legit. The question mark can be any random letter or number. It should be under your user name and not system.

javaw.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R3 - URLSearchHook: (no name) - {FC49BAA7-0936-21BC-13A2-05F2C97342B7} - C:\WINDOWS\system32\laocddd.dll

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)

O4 - HKCU\..\Run: [Sen] "C:\WINDOWS\RACLE~1\javaw.exe" -vt yazr

O4 - HKCU\..\Run: [Fpxvvt] C:\Program Files\Common Files\s?stem32\s?rvices.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\WINDOWS\RACLE~1\javaw.exe
C:\Program Files\Common Files\s?stem32\s?rvices.exe
C:\WINDOWS\system32\laocddd.dll

Reboot into normal mode and turn system restore back on.

Post a fresh HJT log.

Regards Howard

 

[flm74]

Ok, done and done. Here is the fresh HJT.log.

 

[howard_hopkinso]

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

MyWaySA\SrchAsDe

Close control panel.

Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\MyWaySA

Reboot your computer and post a fresh HJT log.

Regards Howard

 

[flm74]

Thanks so much for your help so far Howard, here is the latest HJT.log.

 

[howard_hopkinso]

Your HJT log is now clean.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of flm74 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[flm74]

I can't thank you enough man, really, you guys provide a great service to those in need.

 

[flm74]

Ok, having some new problems. Whenever I try to open a folder or access "my computer" all of my desktop icons vanish.

 

[howard_hopkinso]

Post a fresh HJT log and I`ll check to see if it`s clean or not.

Regards Howard

 

[flm74]

I can't even open up my computer or even run a search to get to hjt, everything vanishes when i try. going to try booting into safe mode and see what happens.

 

[howard_hopkinso]

You might want to try the last known good config option, instead of safe mode.

Regards Howard

 

[flm74]

Reposted log, the one above was inaccurate.

 

[howard_hopkinso]

Your HJT log is still clean.

Try doing a Windows repair as per this thread HERE. It may help.

Regards Howard