Ads served by dcads

ashb920 · February 18, 2008

hii .. i have run all 3 procedures .. and this is the log i have gotten ... if someone can help me get rid of the ads by dcads i would greatly appriciate it .. thank u ..

but yeauh im going to paste the stuff here i got from the virus scans

Malwarebytes' Anti-Malware 1.03

Database version: 365

Scan type: Quick Scan

Objects scanned: 23946

Time elapsed: 3 minute(s), 44 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

<<<<<<<<<<<<<<<<<<<<<<<<<<<<panda scan>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Incident Status Location

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Ashish\Application Data\Mozilla\Firefox\Profiles\znkhw4fi.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Ashish\Application Data\Mozilla\Firefox\Profiles\znkhw4fi.default\cookies.txt[.questionmarket.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Ashish\Application Data\Mozilla\Firefox\Profiles\znkhw4fi.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Ashish\Application Data\Mozilla\Firefox\Profiles\znkhw4fi.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Ashish\Application Data\Mozilla\Firefox\Profiles\znkhw4fi.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Ashish\Application Data\Mozilla\Firefox\Profiles\znkhw4fi.default\cookies.txt[.adultfriendfinder.com/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Ashish\Cookies\ashish@ads.pointroll[1].txt

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Ashish\Cookies\ashish@advertising[1].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Ashish\Cookies\ashish@atdmt[2].txt

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Ashish\Cookies\ashish@atwola[1].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Ashish\Cookies\ashish@doubleclick[2].txt

Possible Virus. Not disinfected C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<this is from hijack this .. >>>>>>>>>>>>>>>>>>>>

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:29:38 AM, on 2/17/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe

C:\WINDOWS\SYSTEM32\CTXFISPI.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKUS\S-1-5-21-507921405-1202660629-725345543-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')

O4 - HKUS\S-1-5-21-507921405-1202660629-725345543-1004\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User '?')

O4 - S-1-5-18 Startup: Internet Explorer.lnk = C:\Program Files\Internet Explorer\IEXPLORE.EXE (User '?')

O4 - .DEFAULT Startup: Internet Explorer.lnk = C:\Program Files\Internet Explorer\IEXPLORE.EXE (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O20 - AppInit_DLLs: cru629.dat

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: wenyuxni - wenyuxni.dll (file missing)

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 5529 bytes

JeanInMontana · February 19, 2008

Hi and welcome to Malwarebytes. Your version of MBAM is not current, please update it. You appear to have a root kit, which means your system is compromised in the worst way. All sensitive data may have been or is being seen by others. Change all passwords immediately and notify all institutions such as banking and credit cards. We can continue with removal, but the only sure way to know your clean is to reformat.

If you wish to proceed please do the following.

Set your system to show all files and folders.

Click Start.

Open My Computer.

Select the Tools menu and click Folder Options.

Select the View Tab.

Under the Hidden files and folders heading select Show hidden files and folders.

Uncheck the Hide protected operating system files (recommended) option.

Click Yes to confirm.

Click OK.

Run HJT again in scan only and put a check next to the following items.

O4 - S-1-5-18 Startup: Internet Explorer.lnk = C:\Program Files\Internet Explorer\IEXPLORE.EXE (User '?')

O4 - .DEFAULT Startup: Internet Explorer.lnk = C:\Program Files\Internet Explorer\IEXPLORE.EXE (User 'Default user')

O20 - AppInit_DLLs: cru629.dat

O20 - Winlogon Notify: wenyuxni - wenyuxni.dll (file missing)

Please download this file: http://downloads.andymanchesta.com/RemovalTools/SDFix.exe' rel="external nofollow">

SDFix.exe

* Open the extracted SDFix folder and double click RunThis.bat to start the script.

* Type Y to begin the cleanup process.

* It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.

* Press any Key and it will restart the PC.

* When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.

* Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt

(Report.txt will also be copied to Clipboard ready for posting back on the forum).

* Finally paste the contents of the Report.txt back on the forum.

Reboot your system in Normal Mode. Then post the SDFix log and a new HJT log please.

ashb920 · February 20, 2008

hi.. i have a question before i do so .. will formatting erase all the data i have saved on my computer??

and also another problem i think i should let u kno about is that i am unable to installl the latest windows security updates .. it always says some files could not be installed.. i dont kno if it has any reference with this but i was just letting you know.. kk thanx.. let me know ..

also when i run HJT and i put a check next to the files .. do i click on fix checked?? or what do i do after i check it ... ?? im guessing click on fix checkd.. but u didnt specify so im not sure..

ashb920 · February 20, 2008

* Open the extracted SDFix folder and double click RunThis.bat to start the script.

* Type Y to begin the cleanup process.

kk i was trying it and i downloaded it .. and i tried pressing Y and then enter and it kept closing.. then i tried pressing U enter to update.. and it did.. but yea theres no Y option when i click on runthis.bat .. .. but this is what it says

To run the SDFix tool please reboot to Safe Mode

(Reboot, tap the F8 Key and choose Safe Mode from the Advanced Menu)

(SDFix Requires Administrator Account Privileges)

1. Download/Run a-squared (EMSI Software - 15.5 MB)

2. Download/Run Norman Malware Cleaner (Norman - 3.5 MB)

3. Download/Run SAV32CLI (Sophos - 11.5 MB)

4. Download Kaspersky Anti-Virus S.O.S. (Visit Kaspersky Lab)

A. Create System Report

B. Create Service/Driver List

C. Create Catchme Log

D. Export SafeBoot Key

U. Download latest version of SDFix

E. EXIT

(Active Internet Connection Required To Download Files)

Type A,B,C,D,U,1,2,3,4 or E to Exit....

.. soo thers no Y option at all at the bottom.. what should i do ?? am i doing something wrong maybe?? thanx.. lemmi kno byee

JeanInMontana · February 20, 2008

It doesn't mean an option. It is just as it says. Type Y and hit enter. It is very fast and appears to close, it's working. Look for the log in the folder on C:/ and post that log please.

hi.. i have a question before i do so .. will formatting erase all the data i have saved on my computer??
and also another problem i think i should let u kno about is that i am unable to installl the latest windows security updates .. it always says some files could not be installed.. i dont kno if it has any reference with this but i was just letting you know.. kk thanx.. let me know ..
also when i run HJT and i put a check next to the files .. do i click on fix checked?? or what do i do after i check it ... ?? im guessing click on fix checkd.. but u didnt specify so im not sure..

Reformatting wipes the disk clean, all data is gone. Back it up now. What sort of error messages when you try to do updates? Very likely it is the malware. Yes you click fix after checking the lines in HJT, sorry that wasn't more clear.

With the update issues and rootkit you may want to seriously consider reformat.

ashb920 · February 22, 2008

i was reading through the information over and over.. and im pritty sure i have to do the sdfix in safemode.. but i have another problem.. when i restart the computer and i keep pressing F8 no safemode option or nything comes up .. it goes straight to the windows loading.. so i tried running the sdfix there.. and when i press Y enter.. then it just closes and when i restart after that thers no log or anything .. so i guess thers no way for me to post it? cause i cant get into safe mode right?? or am i doing something wrong.. cause i been in safemode before so i know im not doing that wrong.. and i pressed F8 from the start or reboot till like the windows blue screen .. so i didint miss it or nything.. any suggestions??

also how would i go about reformatting the computer??? .. i need the windows cd? i have windows home edition cd..

thanx for all your help..

JeanInMontana · February 22, 2008

Let's give this a try. I'm not seeing what made me say root kit. Embarrassing as that is, I might have been looking at two logs and confused them.

Look in Add/Remove programs for anything with DCADS in it. A tool bar is usually associated.

Then let's run this tool

Print or Copy these instructions to notepad and save to your Desktoop as you will be offline with all browsers closed for this fix.

Download:

Use this URL to download the latest version (the file contains both English and French versions):

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

* Double-click SmitfraudFix.exe

* Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt

Clean:

* Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)

* Double-click SmitfraudFix.exe

* Select 2 and hit Enter to delete infect files.

* You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.

* The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.

* A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt

* Optional:

o To restore Trusted and Restricted site zone, select 3 and hit Enter.

o You will be prompted: Restore Trusted Zone ? answer Y (yes) and hit Enter to delete trusted zone.

Note:

process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

http://www.beyondlogic.org/consulting/proc...processutil.htm

ashb920 · February 23, 2008

heyy .. theres no dcads in add/remove ... i think there was the toolbar and something else like 2 weeks back but i removed it .. i guess it never came back up ..

but i ran everything and this is the rapport i got

not sure if u need to c it .. but im going to post it

ashb920 · February 23, 2008

SmitFraudFix v2.294

Scan done at 12:45:07.70, Sat 02/23/2008

Run from C:\Documents and Settings\Ashish\Desktop\SmitfraudFix

OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in safe mode

ashb920 · February 23, 2008

JeanInMontana · February 26, 2008

Hi sorry I overlooked this yesterday. I would still like to see a log from SDfix. It is not due the root kit. What symptoms are you still having? A new HJT with the SDfix please. You can delete Smitfraud before running SDfix.

ashb920 · March 6, 2008

Hi sorry I overlooked this yesterday. I would still like to see a log from SDfix. It is not due the root kit. What symptoms are you still having? A new HJT with the SDfix please. You can delete Smitfraud before running SDfix.

hey sorry it took a while to do ..

SmitFraudFix v2.294

Scan done at 12:45:07.70, Sat 02/23/2008

Run from C:\Documents and Settings\Ashish\Desktop\SmitfraudFix

OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in safe mode

Edited March 6, 2008 by JeanInMontana
Remove scroll time...excess host file info

ashb920 · March 6, 2008

Edited March 6, 2008 by JeanInMontana
Remove scroll time...excess host file info

ashb920 · March 6, 2008

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:29:00 PM, on 3/6/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe