Can someone look at this hijack scan log

[worthatry]

In particlar, I am suspicious of:

O4 - HKLM\..\Run: [SCANREGW] scanregw.exe

and:

O17 - HKLM\System\CCS\Services\Tcpip\..\{E2893621-4AB5-4600-ADA9-4189D54C19B5}: NameServer = 205.188.146.146


Thank to anyone for help!


Logfile of HijackThis v1.97.3
Scan saved at 10:42:20 AM, on 4/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\System32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\PackethSvc.exe
C:\WINNT\System32\svchost.exe
C:\InocuLAN\INOJOBSV.EXE
C:\WINNT\LogWatNT.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\ZipToA.exe
C:\WINNT\Explorer.EXE
C:\InocuLAN\realmon.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\America Online 7.0a\waol.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\POV\compsafe\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SCANREGW] scanregw.exe
O4 - Global Startup: InoculateIT Realtime Monitor.LNK = C:\InocuLAN\realmon.exe
O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0a\aoltray.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O15 - Trusted Zone: http://www.ebay.com
O15 - Trusted Zone: http://www.fleet.com
O15 - Trusted Zone: http://www.nwa.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2893621-4AB5-4600-ADA9-4189D54C19B5}: NameServer = 205.188.146.146

 

[Cookiegal]

While you wait for a reply, please download the latest version of Hijack This, which is v1.97.7 and then post another log.

You can get it here:

http://www.sherrylynn.us/HijackThis.exe

Here is some info on scanregw.exe from a search I did on Google.

scanregw - scanregw.exe - Process Information
Process File: scanregw or scanregw.exe
Process Name: Microsoft’s Registry Checker.
Description: Application that is used to check the integrity of the Windows registry. The application starts on boot up and checks the registry for errors. On finding major errors, the application informs the user to restore from backup; otherwise, the application fixes minor errors.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A


Cookie

 

[dvk01]

I don't remember seeing scanregw in a W21K log before

it's usual in 98/ME and if it's an upgrade from those systems it gets carried over.

sometimes it is a virus in W2K or XP so
to be safe check out the file itself by uplaoding to any on or if you prefer all of these online check sites
http://www.kaspersky.com/remoteviruschk.html
http://www.dials.ru/english/www_av/
http://www.ravantivirus.com/scan/indexn.php


This entry is OK and is an AOL nameserver so you woon't get far tryin g to surf without it
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2893621-4AB5-4600-ADA9-4189D54C19B5}: NameServer = 205.188.146.146

 

[worthatry]

kaspersky virus check revealed this:

Current object: scanregw.exe

scanregw.exe Packed: ASPack
scanregw.exe Infected: TrojanSpy.Win32.GWGhost.h


Statistics:
Known viruses: 85843 Updated: 10.04.2004
File size (Kb): 37 Scan time: 00:00:01
Speed (Kb/sec): 37 Virus bodies: 1
Archives: 0 Packed: 1
Folders: 0 Files: 1
Suspicious: 0 Warnings: 0

 

[dvk01]

before you delete the file please zip it if poss & send it to me at submit@thespykiller.co.uk

I wan=t to check if it's anew version, if so I'll send it on to all the antivirus/trojan developers to include


right then
Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked

O4 - HKLM\..\Run: [SCANREGW] scanregw.exe


Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
then as some of the files or folders you need to delete may be hidden do this:
Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Delete these files

scanregw.exe I assume it's in c:\winnt\system32 but you obviously found it before

then run a full antivirus scan
un an online antivirus check from at least one and preferably 2 of the following sites
http://security.symantec.com/default.asp?
http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/
http://www.ravantivirus.com/scan/
http://www3.ca.com/virusinfo/
Now I don't see any running antivirus, that is a bit like standing in downtown Baghdad stark naked with a bulls eye on your chest waving an American Flag. Definitely not recommended

Download and install & run an antivirus immediately

lists here
http://www.wilders.org/anti_viruses.htm

one free one that many users of this forum use successfully is
AVG from http://www.grisoft.com/us/us_dwnl_free.php

then when all that is done post a new hijackthis log to check all is clear.

 

[dvk01]

It's Ok io got it and the antiviruses jumped in and killed it straight away