BLUE STAR??? HJT list included

Unknown

First off im an american soldier currently deployed to Iraq so i dont have a great internet connection please bear with me as it might take a bit for me to respond.

My issue is i smme to have cought some kind of trogen. All my windows say "bluestar" and have been re colored. None of the standard theme stuff in windows can make it go away. Several of the other computer out here are starting to get the same this as well. That leads me to beleave that its some sort of virus thats beeing spread by thumb drive. I completed scans with Ad-aware 2007, spybot S&D and symantec endpoint protection. they did catch a few things but not the bluestar. I was unable to complete the online virus scans because of my crap deployed internet service.

Included is a HJT list and a screen shot of the Bluestar crap that were catching,

Thank you for any help and please remember that it may take a little for me to respond ~SGT Goldfarb


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:14:04 PM, on 12/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\BisonCam\BisonTrayIcon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Tasks\Scvhost.exe
c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Documents and Settings\Dave\Desktop\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [BisonTrayIcon] C:\WINDOWS\BisonCam\BisonTrayIcon.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [load] C:\WINDOWS\Tasks\Scvhost.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1192969620843
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195741775265
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{411FB0F3-36BD-4B0C-AADF-D5CE80EC847C}: NameServer = 203.130.2.3,203.130.2.4
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Application Lay Server (Appli) - Unknown owner - C:\WINDOWS\winlogon.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Cryptainer service (ssoftservice) - Cypherix - C:\WINDOWS\SYSTEM32\ssoftsrv.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
--
End of file - 7318 bytes

gringo_pr

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems. HijackThis logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that it happens.

Please observe the following while we work:
If you don't know, stop and ask! Don't continue, we don't want to start all over again!
Understand that cleaning your computer can sometimes take multiple passes/posts, and it's important to follow the steps in the order that I give them including re-running scans if needed. If you don't follow the instructions in the order I give them or you try something you read in another post you can reinfect this computer again and we will have to start over.
Please reply to this thread, do not start another.
Please tell me about any problems that have occurred during the fix.
Please tell me of any other symptoms you may be having as these can help also.
Please try as much as possible not to run anything while executing a fix.

As I am still on training, everything that I post to you, must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long.

If you follow these instructions, everything should go smoothly.

we are currently looking at your log now and will be back as soon as possible with your instructions.

Gringo

Raven543

thank you, i await your next reply. One thing i have noticed is that now when ever i click on a drive from "my computer" it opens in a new window, i have set up the explorer to open in the same window but it starts a new one anyway. Only the first time, once the drive opens in a new window all subsequent folders open in the same window as the should.

SGT Goldfarb

gringo_pr

hello Raven543


One or more of the identified infections is a backdoor trojan.

W32/Agobot-S

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can attempt to clean this machine but i can't guarantee that it will be 100% secure afterwards.

Should you have any questions, please feel free to ask.

Please let us know what you have decided to do in your next post



gringo

Raven543

THank you for reasearching what this is, because i am currently deployed in Iraq i do not have any of the disks to re format so i would like to attempt to clean this system. Thanks again for the help.

gringo_pr

hello Raven543

we will try and clean your computer but you need to realize that you can never completely trust this computer until you reformat it ok


:move hijackthis

I see you are using HJT from a location where it will not work properly . Your copy of HijackThis needs to be in a folder of its own. When HJT fixes anything, it makes backups of the original files in the folder it is in. For this reason it cannot be run from where it is now because the backups will be deleted. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!
The easiest way to do this is to uninstall HJT and then to reinstall it
To uninstall Hijackthis go to add/remove programs and uninstall

To install Click here to download HJTsetup.exe

* Save HJTsetup.exe to your desktop.
* Double click on the HJTsetup.exe icon on your desktop.
* Then you will need to click on install
* At the final dialogue box click Finish and it will launch Hijack This.
* close hijackthis until later

: Download ComboFix

• Download this file from either of the two below listed places :
• 
  http://subs.geekstogo.com/Beta/ComboFix.exe
  http://www.forospyware.com/sUBs/Beta/ComboFix.exe

save it till later

please read all instructions and print them or save them to notepad so you can read them during the fix

Physically disconnect from the internet during the fix and stay disconnected until we reenable your Symantec Endpoint Protection


Disabling Symantec Endpoint Protection with pictures

Disabling Symantec Endpoint Protection

You should keep Symantec Endpoint Protection running at all times, but it may interfer with the fix so we need to disable while we do the fixes
1.To disable Symantec Endpoint Protection, open Symantec Endpoint Protection and then click Change settings from the left menu bar.

2.Click Configure Settings next to Antivirus and Antispyware Protection. Click the File System Auto-Protect tab and uncheck the box labeled Enable File System Auto-Protect. Click OK.

3.Click Configure Settings next to Proactive Threat Protection. Uncheck the boxes labeled Scan for Trojans and worms and Scan for keyloggers. Click OK.

Run combofix

• now double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Important: It is imperative that you reenable Symantec Endpoint Protection once you are done running these fixes. To reenable:
1.Open Symantec Endpoint Protection and then click Change settings from the left menu bar.

2.Click Configure Settings next to Antivirus and Antispyware Protection. Click the File System Auto-Protect tab and check the box labeled Enable File System Auto-Protect. Click OK.

3.Click Configure Settings next to Proactive Threat Protection. Check the boxes labeled Scan for trojans and worms and Scan for keyloggers. Click OK.

send me the log from combo fix
and a new log from hijackthis
Gringo

Raven543

I was able to find and kill the virus with the help of my S6 (the army computer people) however even with the virus removed, the explorer windows still have the logo "bluestar" do you know how to un edit whatever the bug got to make this?
Sorry i steped out of the circle on this one but i am working with the S6 to get this bug off a bunch of the army computers as well as my personal laptop. Just so you can know the bug was running Scvhost.exe hidden in C:\windows\tasks\ and had to be removed in a safe mode dos prompt but the root bug was "new.exe" that ran with a autorun.ini in any and all external drives that you needed to un hide protected operating system files to see.

gringo_pr

glad you are getting some help with this, but there were other things in your log that need to be looked after . I would suggest that you follow my previous post anyways just to make sure there is nothing else to go after.
:move hijackthis

I see you are using HJT from a location where it will not work properly . Your copy of HijackThis needs to be in a folder of its own. When HJT fixes anything, it makes backups of the original files in the folder it is in. For this reason it cannot be run from where it is now because the backups will be deleted. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!
The easiest way to do this is to uninstall HJT and then to reinstall it
To uninstall Hijackthis go to add/remove programs and uninstall

To install Click here to download HJTsetup.exe

* Save HJTsetup.exe to your desktop.
* Double click on the HJTsetup.exe icon on your desktop.
* Then you will need to click on install
* At the final dialogue box click Finish and it will launch Hijack This.
* close hijackthis until later

: Download ComboFix

• Download this file from either of the two below listed places :
• 
  http://subs.geekstogo.com/Beta/ComboFix.exe
  http://www.forospyware.com/sUBs/Beta/ComboFix.exe

save it till later

please read all instructions and print them or save them to notepad so you can read them during the fix

Physically disconnect from the internet during the fix and stay disconnected until we reenable your Symantec Endpoint Protection


Disabling Symantec Endpoint Protection with pictures

Disabling Symantec Endpoint Protection

You should keep Symantec Endpoint Protection running at all times, but it may interfer with the fix so we need to disable while we do the fixes
1.To disable Symantec Endpoint Protection, open Symantec Endpoint Protection and then click Change settings from the left menu bar.

2.Click Configure Settings next to Antivirus and Antispyware Protection. Click the File System Auto-Protect tab and uncheck the box labeled Enable File System Auto-Protect. Click OK.

3.Click Configure Settings next to Proactive Threat Protection. Uncheck the boxes labeled Scan for Trojans and worms and Scan for keyloggers. Click OK.

Run combofix

• now double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Important: It is imperative that you reenable Symantec Endpoint Protection once you are done running these fixes. To reenable:
1.Open Symantec Endpoint Protection and then click Change settings from the left menu bar.

2.Click Configure Settings next to Antivirus and Antispyware Protection. Click the File System Auto-Protect tab and check the box labeled Enable File System Auto-Protect. Click OK.

3.Click Configure Settings next to Proactive Threat Protection. Check the boxes labeled Scan for trojans and worms and Scan for keyloggers. Click OK.

send me the log from combo fix
and a new log from hijackthis
Gringo

gringo_pr

do you still need help with this?


gringo

gringo_pr

how are we doing with this


gringo

downer

Hey!
Thanks for your help Gringo. I'm one of the IA people for this guy's higher headquarters. We're all over it! What we are probably going to end up doing is just wiping the drive with BC Wipe and reloading the OS.

SGT Goldfarb
DO NOT EVER POST VULNERABLITIES ON UNSECURED CHANNELS!!!!!!!!!!!!!!!!!!
WTF were you thinking? I understand you wanted help, but we have proper channels for that. You should have gone to your S6 in the first place. If they need help, they can come to us. If we need help, we can go higher. That's the way it works. Think OPSEC.