Winfog.exe questo sconosciuto! o quasi!

[ballacoilupi72]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\utokdmrl

*******************

Script file located at: \??\C:\WINDOWS\system32\dappyjlw.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file c:\winnt\system32\drivers\Winfog\Winfog.log for deletion
Deletion of file c:\winnt\system32\drivers\Winfog\Winfog.log failed!

Could not process line:
c:\winnt\system32\drivers\Winfog\Winfog.log
Status: 0xc000003a



File c:\windows\system32\drivers\disdn\suka.log not found!
Deletion of file c:\windows\system32\drivers\disdn\suka.log failed!

Could not process line:
c:\windows\system32\drivers\disdn\suka.log
Status: 0xc0000034



File c:\windows\system32\drivers\disdn\svchost.exe not found!
Deletion of file c:\windows\system32\drivers\disdn\svchost.exe failed!

Could not process line:
c:\windows\system32\drivers\disdn\svchost.exe
Status: 0xc0000034



File c:\windows\system32\drivers\Winfog\pro.exe not found!
Deletion of file c:\windows\system32\drivers\Winfog\pro.exe failed!

Could not process line:
c:\windows\system32\drivers\Winfog\pro.exe
Status: 0xc0000034



File c:\windows\system32\drivers\Winfog\service.exe not found!
Deletion of file c:\windows\system32\drivers\Winfog\service.exe failed!

Could not process line:
c:\windows\system32\drivers\Winfog\service.exe
Status: 0xc0000034

File c:\windows\system32\drivers\Winfog\cygcrypt-0.dll deleted successfully.
File c:\windows\system32\drivers\Winfog\cygwin1.dll deleted successfully.


File c:\windows\system32\drivers\Winfog\lsass.exe not found!
Deletion of file c:\windows\system32\drivers\Winfog\lsass.exe failed!

Could not process line:
c:\windows\system32\drivers\Winfog\lsass.exe
Status: 0xc0000034

File c:\windows\system32\drivers\Winfog\rarnew.dat deleted successfully.
File c:\windows\system32\drivers\Winfog\BugSlayerUtil.dll deleted successfully.


File c:\windows\system32\drivers\Winfog\move.txt not found!
Deletion of file c:\windows\system32\drivers\Winfog\move.txt failed!

Could not process line:
c:\windows\system32\drivers\Winfog\move.txt
Status: 0xc0000034



File c:\windows\system32\drivers\Winfog\h3yb0y.reg not found!
Deletion of file c:\windows\system32\drivers\Winfog\h3yb0y.reg failed!

Could not process line:
c:\windows\system32\drivers\Winfog\h3yb0y.reg
Status: 0xc0000034



File c:\windows\system32\drivers\Winfog\kit.exe not found!
Deletion of file c:\windows\system32\drivers\Winfog\kit.exe failed!

Could not process line:
c:\windows\system32\drivers\Winfog\kit.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\Winfog\LSASS.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\Winfog\LSASS.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\Winfog\LSASS.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\Winfog\service.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\Winfog\service.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\Winfog\service.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\Winfog\conf.dll deleted successfully.


File C:\WINDOWS\system32\drivers\Winfog\LSASS.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\Winfog\LSASS.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\Winfog\LSASS.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\Winfog\system.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\Winfog\system.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\Winfog\system.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\Winfog\serv-u.ini deleted successfully.


File C:\WINDOWS\system32\drivers\Winfog\LSASS.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\Winfog\LSASS.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\Winfog\LSASS.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\Winfog\server.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\Winfog\server.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\Winfog\server.exe
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[ste_95]

alcuni files li ha trovati ed eliminati, ora non c'è più nulla di winfog...!

[ballacoilupi72]

Grazie Mille!

Speriamo che questo topic possa essere utile e informare anche altri utenti su WinFog!

[ste_95]

Mi è capitato di nuovo in mano quell'archivio con i backup, e ho fatto analizzare nuovamente il file Unistall.exe su VirusTotal: Solo eSafe lo riconosce senza utilizzare l'euristica. Lo ho mandato questa mattina sia a Kaspersky che ad Avira, Kaspersky non mi ha ancora risposto, mentre Avira prontamente mi ha detto che il file era KNOWN CLEAN, giudizio che non avevo mai sentito prima. Mi diceva anche che il file faceva parte dell'applicazione "Digilabs My Photo Calendars 3.2". La conosci?

[ballacoilupi72]

Mi diceva anche che il file faceva parte dell'applicazione "Digilabs My Photo Calendars 3.2". La conosci?

mai conosciuta o installata...

[ste_95]

BAH, hai per caso un qualche installer di 'sta "roba"?

[ballacoilupi72]

BAH, hai per caso un qualche installer di 'sta "roba"?

assolutamente no...