ishost.exe

[vchris]

I think I may have downloaded somekind of virus. Since I downloaded a program from a site and executed the exe file I'm having the following pop-up on windows startup.

Update.exe - Unable to locate componentThis application has failed to start because MSVCR71.dll was not found. Re-installing the application may fix this problem.

I also have Panda antivirus and firewall. On startup I also get a pop-up from my firewall saying that ishost.exe is trying to access the internet. ishost.exe comes from c:\windows\system32\ishost.exe.I searched on google but couldn't find much and I did virus and spyware scans.

[reportingsjr]

I would say yes... If its trying to access the internet, unless it is some type of program for taxes or something (my mom has one for her bank accounts and suff, but its microsoft access or something) then its not.So if you arent sure and dont really need it quarentine it and delete it..

[vchris]

The problem is that when I scan that file specificaly with my antivirus or antispyware they don't see anything wrong with it. When scanning my whole system they don't find anything. My antivirus is Panda and my antispyware is ad-aware and spybot.

[reportingsjr]

Exactly wat kind of program is this supposed to be? Is it supposed to be like php or something?

[Jack McKalling]

If this program is from a trusted resource, then the resource should be reconsidered :)ishost.exe is not a trusted file, if it tries to access the internet without you knowing of what it is likely that it should do, as in knowing Messenger needs internet access, it should not be given permission. What was the purpose of this file when you downloaded it?You can just delete the malicious file and see if that solves the problem, or search for a different antivirus or antispyware. I have Zone Labs ZoneAlarm, Norton AntiVirus and Webroot SpySweeper, and I have never had problems concerning malware [*Edit:]You SHOULD consider an anti spyware program, as if you only have antivirus and firewall, you won't be protected from spy ware, with which you are dealing with right now. ishost.exe is spy ware.

[dorothy]

You should get rid off it today.Check more details here: http://www.computing.net/security/wwwboard/forum/19134.htmldorothy

[vchris]

If this program is from a trusted resource, then the resource should be reconsidered :)ishost.exe is not a trusted file, if it tries to access the internet without you knowing of what it is likely that it should do, as in knowing Messenger needs internet access, it should not be given permission. What was the purpose of this file when you downloaded it?You can just delete the malicious file and see if that solves the problem, or search for a different antivirus or antispyware. I have Zone Labs ZoneAlarm, Norton AntiVirus and Webroot SpySweeper, and I have never had problems concerning malware [*Edit:]You SHOULD consider an anti spyware program, as if you only have antivirus and firewall, you won't be protected from spy ware, with which you are dealing with right now. ishost.exe is spy ware.

I currently use 2 anti-spyware program, ad-aware and spybot and none of them found it.I remember this program was downloaded from a site that's not trusted (crack site) and then when I clicked the exec the icon itself disappeared from my desktop and I then started getting this pop-up on boot.Do you have the file ishost.exe in windows/system32? I might just delete it.

[aspnetguy]

dorothy's post seems to suggest it is a worm or hijack of some sort. Read the link in their post to verify this....if it is...get rid of it.

[vchris]

Seems like I have this: http://www.sophos.com/security/analyses/trojdloadrxj.html

[Jack McKalling]

I know you have ad-aware and spybot, as you said earlier, but I have had those two too. And when I got myself a Spy Sweeper, I was astonished even how much this anti spyware program could find and remove. Which the other two couldn't! Unfortunately, when I got SS, is long ago. I can't find myself a free version online to download anymore, so my own free version has been replaced on the internet by a trial version (shareware). If you like the idea of Spy Sweeper that claims to be better (in my opinion and of much others) than the others, I may give it to you a copy of my free version somehow (or I can publish it if more are interested)

[justsomeguy]

I was asked to clean someone's computer a year ago or so, they had really messed it up with quite a few things and didn't want to reinstall. They were running AOL and Windows ME, among other programs as well-designed as those. I forget the name of the real stubborn infection, but after a few days I was able to exorcise it.One thing you can do is go to www.pandasoftware.com and run the ActiveScan. It will use an ActiveX control to scan your computer based on the definitions on the Panda server. Some malware will block access to pandasoftware.com and other AV vendors.One very helpful tool I used was HijackThis. You can download it from merijn.org. It will scan your computer and give you a list of various settings where hijackers and trojans hide themselves. It should be noted that not all of the entries reported by HijackThis are malware, it will list legitimate browser helper objects, changes to homepage settings, ActiveX controls, etc. These are places where hijackers hide, but that doesn't mean that everything in there is bad.Since it's hard to tell yourself, you will probably want to post your HijackThis log file on a forum and get some people who specialize in this to help you identify and remove different threats. This is probably the single best place for that type of help:http://www.broadbandreports.com/forum/cleanupBefore you post there, take a few hours and read the "Mandatory Steps", do what they have to say there. Those steps might solve the problem for you. If not, then you will be able to write a much more informative post about your problem, and you will receive better help faster.

[vchris]

I think I'll first try that spy sweeper program then I'll try the sophos antivirus and if they can't remove it then I'll try hijackThis. I've seen log files from Hijackthis and it seems to solve some issues when you know what you're doing.

[justsomeguy]

HijackThis itself doesn't solve anything, it just tells you what it finds on your system. Most of the time it's still up to you to track it down and delete it. You can remove the entries that HijackThis finds with the program, but 99% of the time the program that made them will remake them.

[SFB]

HijackThis itself doesn't solve anything, it just tells you what it finds on your system. Most of the time it's still up to you to track it down and delete it. You can remove the entries that HijackThis finds with the program, but 99% of the time the program that made them will remake them.

I used hijack this and ctrl-alt-delete to solve my problems. i just wrote down all the running proccesses (when i was experiencing the virus/malware thing) then looked them all up. found out i had two evil processes and then that website told me what to do then i found the root of all the evil on my computer and deleted it. then when i was sure it was gone i made a new restore point so it wouldnt come back if i had to restore my pc. all is good now

[Jack McKalling]

Spy Sweeper is very good for most spyware/adware, but my free version cannot be updated without payment. Though it can still find loads of malicious mess. If you are experiencing "CoolWebSearch" or "CWS", which is one of the most malicious spyware I know of, you should use a special program to find and destroy CWS. Manually, it is impossible to remove it. It is the most effective threat to hijack your homepage, insert irremovable icons on the desktop, popups, slow windows, and maybe even more. It is ######.Also, for this threeat I have a special program, free, that can remove any CWS installation on your computer. If this name is familiar with you or any of your friends, I'll be happy to hand my program over to you, as I find this threat so damned I want the whole world free of it. More or less

[vchris]

Spy Sweeper is very good for most spyware/adware, but my free version cannot be updated without payment. Though it can still find loads of malicious mess. If you are experiencing "CoolWebSearch" or "CWS", which is one of the most malicious spyware I know of, you should use a special program to find and destroy CWS. Manually, it is impossible to remove it. It is the most effective threat to hijack your homepage, insert irremovable icons on the desktop, popups, slow windows, and maybe even more. It is ######.Also, for this threeat I have a special program, free, that can remove any CWS installation on your computer. If this name is familiar with you or any of your friends, I'll be happy to hand my program over to you, as I find this threat so damned I want the whole world free of it. More or less

I tried the demo version and looks nice and finds lots of spyware that ad-aware and spybot couldn't find. Are you talking about the demo version? Can you remove the spywares?

[justsomeguy]

For CoolWebSearch, there is a utility originally written by the author of merijn.org available here:http://www.intermute.com/spysubtract/cwshr...r_download.html

[Jack McKalling]

For CoolWebSearch, there is a utility originally written by the author of merijn.org available here:http://www.intermute.com/spysubtract/cwshr...r_download.html

I was talking about exactly that progrtam "CWS Shredder". I rarely use it, while I haven't had any CWS since my Spy Sweeper.The version I have is not a demo version, that is what I mean. This version was firstly what right now the demo is. My version os yet totally free unless you are willing to pay for the full version. The reason why I personally want to give this to you, is because you can only find the demo online.

[aspnetguy]

so you are pirating software now huh? is it a free program you just can't find anymore or has the company started charging for it?

[Jack McKalling]

I don't know the background reason, I just can't find "Spy Sweeper Free" anymore :)Either one of those two is the case, it can be a free program (it is) that I can't find anymore, or they started charging for it. At least for "Spy Sweeper" I mean.There are more SS versions to be found on their site, a Full version and possibly more full versions, and a demo. And in the past, the demo, or the title of the not-full version, was "Free"If you put it like that, pirating software, I might just decline giving it, like I not like doing somethin gillegal But still, I want more people to be equiped with this incredible tool.

[aspnetguy]

I was joking...if it was free when you got it I don't see why you couldn't give it to someone else unless the company has said something different

[Jack McKalling]

Okay :)Well it might just be that this programm wasn't replaced by, but altered in a payed version. In that case, they mean not to support the free one anymore, and then I would do something illegal. But that is up to them, they should have made the decision of charging before they supported the free version :hypocrite:I mailed the SS Free version to vchris, but I don't know if he has received it or not, while it is a zipped .exe file, that may be intercept by his mail server. If someone knows how to post or in general publish this .exe file, I'll happy to listen. I may have uploaded it just to my server, but it is down for the moment.

Edited August 23, 2006 by Dan The Prof

[vchris]

I thought you were talking about a cracked version of somekind. Then if it's legal + free, I'm even more interested

[Jack McKalling]

Lol. That is what it is :)Legal, I am not sure. But, not cracked, thats for sure. It was on the net right as it is, though not anymore :)Do you have WinRAR?

[vchris]

Oh ok. Yeah I do have WinRAR. SHIIIIIIIIIP it!