1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Can someone look at this hijack scan log

Discussion in 'Virus & Other Malware Removal' started by worthatry, Apr 10, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. worthatry

    worthatry Thread Starter

    Joined:
    Oct 21, 2003
    Messages:
    43
    In particlar, I am suspicious of:

    O4 - HKLM\..\Run: [SCANREGW] scanregw.exe

    and:

    O17 - HKLM\System\CCS\Services\Tcpip\..\{E2893621-4AB5-4600-ADA9-4189D54C19B5}: NameServer = 205.188.146.146


    Thank to anyone for help!


    Logfile of HijackThis v1.97.3
    Scan saved at 10:42:20 AM, on 4/10/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\System32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\System32\PackethSvc.exe
    C:\WINNT\System32\svchost.exe
    C:\InocuLAN\INOJOBSV.EXE
    C:\WINNT\LogWatNT.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\wanmpsvc.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\System32\mspmspsv.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\ZipToA.exe
    C:\WINNT\Explorer.EXE
    C:\InocuLAN\realmon.exe
    C:\WINNT\system32\wuauclt.exe
    C:\Program Files\America Online 7.0a\waol.exe
    C:\Program Files\Microsoft Office\Office\WINWORD.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\POV\compsafe\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [SCANREGW] scanregw.exe
    O4 - Global Startup: InoculateIT Realtime Monitor.LNK = C:\InocuLAN\realmon.exe
    O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0a\aoltray.exe
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Create Mobile Favorite (HKLM)
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: ICQ Lite (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
    O15 - Trusted Zone: http://www.ebay.com
    O15 - Trusted Zone: http://www.fleet.com
    O15 - Trusted Zone: http://www.nwa.com
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{E2893621-4AB5-4600-ADA9-4189D54C19B5}: NameServer = 205.188.146.146
     
    worthatry, Apr 10, 2004
    #1
  2. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,203
    While you wait for a reply, please download the latest version of Hijack This, which is v1.97.7 and then post another log.

    You can get it here:

    http://www.sherrylynn.us/HijackThis.exe

    Here is some info on scanregw.exe from a search I did on Google.

    scanregw - scanregw.exe - Process Information
    Process File: scanregw or scanregw.exe
    Process Name: Microsoft’s Registry Checker.
    Description: Application that is used to check the integrity of the Windows registry. The application starts on boot up and checks the registry for errors. On finding major errors, the application informs the user to restore from backup; otherwise, the application fixes minor errors.
    Company: Microsoft Corp.
    System Process: Yes
    Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
    Common Errors: N/A


    Cookie
     
    Cookiegal, Apr 10, 2004
    #2
  3. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,236
    First Name:
    Derek
    I don't remember seeing scanregw in a W21K log before

    it's usual in 98/ME and if it's an upgrade from those systems it gets carried over.

    sometimes it is a virus in W2K or XP so
    to be safe check out the file itself by uplaoding to any on or if you prefer all of these online check sites
    http://www.kaspersky.com/remoteviruschk.html
    http://www.dials.ru/english/www_av/
    http://www.ravantivirus.com/scan/indexn.php


    This entry is OK and is an AOL nameserver so you woon't get far tryin g to surf without it
    O17 - HKLM\System\CCS\Services\Tcpip\..\{E2893621-4AB5-4600-ADA9-4189D54C19B5}: NameServer = 205.188.146.146
     
    dvk01, Apr 10, 2004
    #3
  4. worthatry

    worthatry Thread Starter

    Joined:
    Oct 21, 2003
    Messages:
    43
    kaspersky virus check revealed this:

    Current object: scanregw.exe

    scanregw.exe Packed: ASPack
    scanregw.exe Infected: TrojanSpy.Win32.GWGhost.h


    Statistics:
    Known viruses: 85843 Updated: 10.04.2004
    File size (Kb): 37 Scan time: 00:00:01
    Speed (Kb/sec): 37 Virus bodies: 1
    Archives: 0 Packed: 1
    Folders: 0 Files: 1
    Suspicious: 0 Warnings: 0
     
    worthatry, Apr 10, 2004
    #4
  5. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,236
    First Name:
    Derek
    before you delete the file please zip it if poss & send it to me at [email protected]

    I wan=t to check if it's anew version, if so I'll send it on to all the antivirus/trojan developers to include


    right then
    Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked

    O4 - HKLM\..\Run: [SCANREGW] scanregw.exe


    Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    then as some of the files or folders you need to delete may be hidden do this:
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    Delete these files

    scanregw.exe I assume it's in c:\winnt\system32 but you obviously found it before

    then run a full antivirus scan
    un an online antivirus check from at least one and preferably 2 of the following sites
    http://security.symantec.com/default.asp?
    http://housecall.trendmicro.com/
    http://www.pandasoftware.com/activescan/
    http://www.ravantivirus.com/scan/
    http://www3.ca.com/virusinfo/
    Now I don't see any running antivirus, that is a bit like standing in downtown Baghdad stark naked with a bulls eye on your chest waving an American Flag. Definitely not recommended

    Download and install & run an antivirus immediately

    lists here
    http://www.wilders.org/anti_viruses.htm

    one free one that many users of this forum use successfully is
    AVG from http://www.grisoft.com/us/us_dwnl_free.php

    then when all that is done post a new hijackthis log to check all is clear.
     
    dvk01, Apr 10, 2004
    #5
  6. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,236
    First Name:
    Derek
    It's Ok io got it and the antiviruses jumped in and killed it straight away
     
    dvk01, Apr 12, 2004
    #6

  7. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - someone hijack scan
  1. TechDef

    New Is Someone Spying on Me with Mobicip?

    TechDef, Oct 20, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    316
    TechDef
    Oct 20, 2019
  2. bj nick

    New Laptop plagued by browser hijacker....help!

    bj nick, Nov 2, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    168
    bj nick
    Nov 2, 2019
  3. jspencer1985

    In Progress Please help, trying to figure out hijack

    jspencer1985, Jan 13, 2019, in forum: Virus & Other Malware Removal
    Replies:
    1
    Views:
    682
    askey127
    Jan 19, 2019
  4. PhoenixNEW

    New Possible hijacking of my PC by some nefarious people

    PhoenixNEW, Jan 6, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    392
    PhoenixNEW
    Jan 6, 2019
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/219009

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice