Jump to content


Malware Changes Winapp.ini file


2 replies to this topic

#1 OFFLINE   valoanpro

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 07 November 2007 - 06:30 AM

Apparently I have a malware file on my computer that has changed the WINAPP.INI file so that
the "MARKED FOR DELETION" files (below) are not included in the scheduled cleaning.

These files were NOT INCLUDED until I made changes by copying the CCleaner files to the
current Program Files location.

I noticed this when checking the ANALYZE function and DELETE function to see what had been removed. Re-installing the program from the orig download did not solve the problem so may be
a file (malware) that changes WINAPP.INI even if re-installed.

These are the files in question on my computer (running XP professional) -

Marked for deletion: C:\Documents and Settings\Surfcomp Admin\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Marked for deletion: C:\Documents and Settings\Surfcomp Admin\Cookies\index.dat
Marked for deletion: C:\Documents and Settings\Surfcomp Admin\Local Settings\History\History.IE5\index.dat

These are obviously critical files to be deleted. Is there a way for CCleaner to protect the appropriate files or warn admin if changes made??

#2 OFFLINE   fredvries

    CCleaner Expert

  • Members
  • PipPipPip
  • 316 posts
  • Gender:Male
  • Location:Harlingen - The Netherlands

Posted 07 November 2007 - 12:23 PM

A very worrying development.

Did you by any chance happen to visit a poker site, like videopokerclassic.com?

Please send a HijackThis log to the appropiate section in this forum here.

#3 OFFLINE   mushu13

    Advanced Member

  • Members
  • PipPipPip
  • 99 posts

Posted 07 November 2007 - 07:26 PM

So you are saying they are not deleted? Cause windows recreates them on reboot.

Also, there is no external WinApp.ini in the newer versions of CCleaner.
They call them fingers, but I've never seen them fing, or ger. WOAH there they go!!!!!!!
~Otto

How to use CCleaner on a Flash Drive (pre v2.0)