Computer help, logs awaiting

Ok, almost 6 in the morning. Followed the steps and I'm ready to post the logs, or attach them anyway. The problem is that I had a pop up as my desktop wallpaper. The logs are attached..

 

And more...

 

I tried to upload the bdscan but the file exceeded the limit. Any help would be useful and please excuse my newbieness

 

Please see this thread on Using SDFix.

Once you complete the above, attach the results with a fresh HJT log.

 

Alright, ran the SD fix and Hijack This again. The logs are attached, thanks in advance for the help guys

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Please look in Add/Remove Programs for the following and uninstall them if found:

WebRebates

Viewpoint

Please make sure the Viewing of Hidden Files & Folders is enabled per the READ ME.

Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

dujkimgA.exe

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)

O2 - BHO: SDWin32 Class - {024BEFC0-A904-4650-9ECB-BA4E695CA784} - C:\WINDOWS\system32\nzkiq.dll (file missing)
O2 - BHO: Jkzlbfarb Class - {754515CD-5059-4133-B6D5-3757DD84D6C0} - C:\WINDOWS\system32\s9ndzm6.dll (file missing)
O2 - BHO: (no name) - {A21D4749-89D8-D475-DCAE-D728EA7031CF} - C:\WINDOWS\system32\iddmckf.dll (file missing)

O4 - HKLM\..\Run: [dujkimgA] C:\WINDOWS\dujkimgA.exe
O4 - HKLM\..\Run: [zymd1091] RUNDLL32.EXE w28b79b5.dll,n 006d108b0000000328b79b5
O4 - HKLM\..\Run: [win32092175599704] C:\WINDOWS\win32092175599704.exe
O4 - HKLM\..\Run: [WebRebates] javaw -cp "C:\Program Files\WebRebates\System\Code" Main lp: "C:\Program Files\WebRebates"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [vFrk35V] nddpress.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nzkiqc] C:\WINDOWS\system32\nzkiqc.exe
O4 - HKLM\..\Run: [ms059704217559] C:\WINDOWS\ms059704217559.exe
O4 - HKLM\..\Run: [Kgjg] "C:\WINDOWS\system32\rnnypbw.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AutoLoadervs0K1PIUPPXa] "C:\WINDOWS\System32\nddpress.exe"
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Joey\MYDOCU~1\SMANTE~1\fast.exe" -vt yazb

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab

O18 - Filter: text/html - {AE3B25B6-4C21-4038-BD35-99A05B5EF3EB} - C:\WINDOWS\system32\s9ndzm6.dll

Again, make sure ALL browser windows are closed when you click FIX.

Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\Program Files\WebRebates ← Delete this whole folder if it exist!

C:\Program Files\Viewpoint ← Delete this whole folder if it exist!

C:\Program Files\ipwins ← Delete this whole folder if it exist!

Next, run CCleaner to clean up cookies and temp files.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, REBOOT and proceed with the rest of this fix...

Next Reset Web Settings & Default Security Settings

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Ok I followed the instructions. The only problem I had was with the restore points. When I right-click the "My Computer" icon on my desktop and go to properties, the only tabs I have are "General" and "Shortcut." The new log is attached. As always, thanks in advance.

 

bump

 

Don't Bump! It Only Hurts You!!!

 

Go into Control Panel and open System, you should find the System Restore tab.

 

Sorry about the bump, didn't mean to break any rules here.

Thanks to your help, I've gotten rid of alot of stuff. I mean, at the very least I got rid of alot of stuff that didn't need to be on my computer. This is the problem I'm still having. I had a pop up on my desktop which is not there anymore. However, now the desktop wallpaper still looks incorrect. I have a white wallpaper but there's a blue border around all of the icons. When I restart my computer the white wallpaper will clear and the blue wallpaper will come out just before it shuts off. Basically, it's like if the white wallpaper is just thrown on top of the blue one, with the blue one still bordering the icons. I can't rid of this and I have no idea what's causing it. Any ideas?

 

Please run this utility below:​

• Please download SmitfraudFix
  
  [*]Extract the content (a folder named SmitfraudFix) to your Desktop.
  
• Open the SmitfraudFix folder and double-click smitfraudfix.cmd
  
• Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
  
• Please copy/paste the content of that report into your next reply.
  
  • NOTE: The file "process.exe" is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

 

Here's the Smitfraud log, as requested.

 

Are you having any further problems?

 

I'm still having the same problem. It doesn't seem like my wallpaper is correct...

 

Ok guys, things are looking good now. The problem I had is gone and as of now everything looks normal. I can't thank you guys enough, hopefully I won't have any more problems in the future. Thanks alot guys, I appreciate the help (and patience).

 

Did you run the previous post by Chaslang? If so, please attach the log.

Run CCleaner, then delete the folder C:\!KillBox\