Dcads virus

Welcome to Major Geeks!

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

READ & RUN ME FIRST. Malware Removal Guide

 

Do you know what the below file is? I would question its validity especially since it is set to hidden, system and read only.
2005-03-30 15:52 186,099 --sh--r C:\WINDOWS\system32\5ev.exe


First please see step 1 of the READ & RUN ME and put MSconfig into normal startup mode as was requested. You should also read this to better understand why: Dealing with Startup Processes

After doing the above continue with below.

Do you use MUSICMATCH Jukebox, if not then uninstall it? It is not malware but it is preinstalled on many PCs and many people never use it. Nor do you need it loading all the time.

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 1
Java(TM) 6 Update 3
Browser Optimizer Dcads <-- should have been uninstalled in step 0 of the READ ME
Enhancement Browser Tools Superiorads <-- should have been uninstalled in step 0 of the READ ME
MySidesearch Search Assistant <-- should have been uninstalled in step 0 of the READ ME
Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.


Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.Begin2Search.com/search.html
O2 - BHO: MySidesearch Search Assistant - {DDFA1356-E6ED-42a5-9D62-93211D424A90} - C:\WINDOWS\System32\mysidesearch_sidebar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

After clicking Fix, exit HJT.


Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

Driver::
isarxdav
 
DirLook::
C:\Program Files\Navilog1
C:\WINDOWS\provisioning
C:\WINDOWS\peernet
C:\WINDOWS\EHome
 
FileLook::
C:\WINDOWS\system32\5ev.exe
 
File::
C:\WINDOWS\System32\drivers\isarxdav.sys
C:\WINDOWS\system32\DcadsSocial-uninstall.exe
C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
C:\WINDOWS\system32\dcads-remove.exe
C:\WINDOWS\system32\superiorads-uninst.exe
C:\WINDOWS\system32\mysidesearch_sidebar.dll
C:\Documents and Settings\Owner\Local Settings\Temp\tmp6.tmp
 
Folder::
C:\Temp\tn3
C:\Program Files\Enigma Software Group
C:\WINDOWS\system32\re9
C:\WINDOWS\system32\kt8
C:\WINDOWS\system32\gz4
C:\WINDOWS\system32\edcA01
C:\WINDOWS\system32\dp2
C:\Temp\Ryuan1
 
Registry::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\DefsIde]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"SunJavaUpdateSched"=-
"MsgCenterExe"=-
"TkBellExe"=-
"QuickTime Task"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegedit"=-

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Also delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\Administrator\Local Settings\Temp

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!