Spyware Woes

[kimmster]

Dear Friends,

Letting you know I troubleshoot machines and know my way around windows fairly well. This trouble/inquiry is for my own personal machine though.

I am running Windows 2000 SP4 & IE6

Not sure of the spyware I have but I think its Vundo? (sp?)
I have tried so many things its exhausting.
I tried hitman pro and its stalling. I have tried PrevX and its having problems but I did manage to get a screencap of what it said it found.
I managed to delete by hand in safe mode all that it said it found, except for one file - gebawww.dll

I am getting all kinds of command prompt screens opening up upon bootup. I am getting lots of browser popups of course. I am also noticing DLLHOST.exe starting up A LOT! It seems to restart almost every time I click/browse a new page.

I installed the newest version of Spybot--and it found a lot. I would be happy to post a log of what it found and corrected last go around. I did it a second time upon bootup because it needed to delete something on reboot, and besides that I had it fix anything else it found. So that is twice now.

I downloaded and tried the newest version of HJT (2.0.0.2) and when starting, it just crashes every time. So I tried running 1.99. When I click for it to scan, it works fine. When I try the scan and log, it crashes at the end of the scan every time. I checked the log file though, and it seems to be posting one, so I shall paste the contents.
Incidentally, when I tried to use the delete file feature in spybot for the gebawww.dll, the moment I click on that button/feature in spybot, it crashes on me too. All else in that program seems to work fine.

I have done much troubleshooting and even cleaning spyware in the past (though havent kept with times and rusty) and troubleshooted machines for years and NEVER has something driven me THIS crazy with problems nor used THIS much time without relief. Pulling hair out, someone, if you could please, help or advise if you can. Thank you in advance...I REALLY appreciate it.

Oh, and I tried Vundofix.exe too.

HTJ log:

Logfile of HijackThis v1.99.1
Scan saved at 4:17:12 PM, on 11/27/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\CTsvcCDA.EXE
E:\Utilities\Norton Av\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
E:\Utilities\Norton Av\Rtvscan.exe
C:\WINNT\system32\Tablet.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Saitek\Software\SaiMfd.exe
C:\WINNT\system32\ctfmon.exe
E:\Internet\Yahoo Messenger\Messenger\YahooMessenger.exe
E:\Document and Office Programs\MS Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\DllHost.exe
E:\Internet\Internet Utilities\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = Download Directory
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/yco...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
F2 - REG:system.ini: UserInit=C:\WINNT\SYSTEM32\Userinit.exe,waevexj.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\ProfilerU.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Second Copy] "E:\Utilities\Second Copy Backup\bak\SecCopy.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\Internet\Yahoo Messenger\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Internet\Internet Utilities\Spybot S-D\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microangelo Desktop.lnk = E:\Desktop and Fun\Microangelo 5\muamgr.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINNT\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &Yahoo! Search - file:///E:\Internet\Yahoo Messenger\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\DOCUME~1\MSOFFI~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///E:\Internet\Yahoo Messenger\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///E:\Internet\Yahoo Messenger\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///E:\Internet\Yahoo Messenger\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - E:\Internet\INTERN~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Internet\Yahoo Messenger\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\DOCUME~1\MSOFFI~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Internet\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Internet\INTERN~1\SPYBOT~2\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Internet\INTERN~1\SPYBOT~2\SDHelper.dll
O15 - Trusted Zone: www.adobe.com
O15 - Trusted Zone: http://www.ezthemes.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: http://kat-korner.spaces.live.com
O15 - Trusted Zone: spaces.live.com
O15 - Trusted Zone: www.neopets.com
O15 - Trusted Zone: www.topdesktop.com
O15 - Trusted Zone: http://www.topdesktop.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.snipenet.net (HKLM)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - https://disneyblast.go.com/v3/setup/...areControl.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/pla.../installer.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{070FEE20-9A69-4645-96EB-D407EFF89DA2}: NameServer = 198.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF9C6209-4940-49D3-8915-8764D33ACAD2}: Domain = suscom.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF9C6209-4940-49D3-8915-8764D33ACAD2}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{070FEE20-9A69-4645-96EB-D407EFF89DA2}: NameServer = 198.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{070FEE20-9A69-4645-96EB-D407EFF89DA2}: NameServer = 198.168.1.1
O20 - AppInit_DLLs: wowexec.dll
O21 - SSODL: IEFilter - {5DCDFD61-93D6-4789-8D72-09438338BD4E} - C:\WINNT\system32\IEFilter.dll (file missing)
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\BlackIce\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTsvcCDA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Utilities\Norton Av\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\BlackIce\rapapp.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINNT\system32\r_server.exe" /service (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - E:\Utilities\Norton Av\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - E:\Internet\Internet Utilities\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - E:\Internet\Internet Utilities\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - E:\Internet\Internet Utilities\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Utilities\Norton Av\Rtvscan.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINNT\system32\Tablet.exe

[kimmster]

P.S....Almost forgot, sorry, I tried Kaspersky Online Scanner as well and got this:

Update process FAILED. No further antivirus actions can be performed!

Attention, you must be online to activate Kaspersky Online Scanner, since the latest Anti-Virus bases version must be downloaded prior to scan. Otherwise we cannot guarantee detection of latest viruses. [21]

So you can further see why I am losing it!

Thanks!