| Scans the system registry and makes back-ups at start-up. Important should the registry become corrupt. The executable "Scanregw.exe" is located in %windir% (where %windir% is the Windows directory - C:Windows or C:Winnt)
|
| Added by the STATOR WORM! Not to be confused with the legitimate ScanRegistry entry - which is a vital Windows file. The executable "Scanregw.exe" is located in %windir%System (where %windir% is the Windows directory - C:Windows or C:Winnt). Runs from the registry RunServices key as opposed to the Run key
|
| Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in the System (9x/ME) or System32 (NT/2K/XP) folder
|
TK
| scanregw.exe /autorun Startup entry in win9x versions is essential system survival startup entry, it runs, performs one registry backup per day at the most permitting restoration of a recent good registry should the registry get munged by power failure. Once it finishes performing the backup it exits freeing resources so it should be left in place and a short delay in the days first startup is a small price to pay for relative peace of mind
|
