Winweb Security 2008 removal

[PatrickB]

Please, someone help me! I can't get rid of the Winweb icon in the toolbar and I have to keep scanning my computer every 5 minutes to get rid of the spyware it keeps sending me. I've tried almost everything, including spyware tools such as Spy Doctor, SpyHunter 3, Malwarebytes, and SmitfraudFix. I also tried a system restore, but it just tells me that it couldn't complete after I rebooted. One of the only things I haven't tried is manually removing the thing from the registry, which I'm hesitant about after being informed that a non-computer guru such as myself has a high risk of destroying my computer and all my files if I mess with it. If anyone knows any other good malware-removal software I can download for free I'm willing to use anything, as long as I don't have to purchase it. I really don't want to buy a $50 piece of software that may or may not get rid of a malware infection that I'm certain I'll never get again. Please please please help me, I just suffered a hard drive crash last year and I REALLY don't want to lose all my files again.

If this helps anyone discover the problem, here is a HiJackThis log I scanned just now:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:18:01, on 12/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\D-Link\RangeBooster G WDA-2320\AirPlusCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\TEMP\tornew.exe
C:\Documents and Settings\All Users\Application Data\917868708\1497670966.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R3 - URLSearchHook: (no name) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: {c713084b-540c-61c9-d444-84b70a7e6789} - {9876e7a0-7b48-444d-9c16-c045b480317c} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: BHOws Object - {D5DF7C9D-6069-4552-8B0C-D02A912FC889} - ws.dll (file missing)
O2 - BHO: (no name) - {EA230B94-3DFF-4E3F-8903-AB3B03376510} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [D-Link RangeBooster G WDA-2320] C:\Program Files\D-Link\RangeBooster G WDA-2320\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [vhostcheck] C:\WINDOWS\TEMP\tornew.exe
O4 - HKLM\..\Run: [1497670966] "C:\Documents and Settings\All Users\Application Data\917868708\1497670966.exe"
O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3EBBC0AC-4918-4016-8205-615B94F919D4}: NameServer = 205.152.37.23,205.152.144.33
O17 - HKLM\System\CCS\Services\Tcpip\..\{6C9732E2-4336-42C5-8F5A-18BEBCB7F8B4}: NameServer = 205.152.37.23,205.152.144.33
O17 - HKLM\System\CS1\Services\Tcpip\..\{3EBBC0AC-4918-4016-8205-615B94F919D4}: NameServer = 205.152.37.23,205.152.144.33
O17 - HKLM\System\CS2\Services\Tcpip\..\{3EBBC0AC-4918-4016-8205-615B94F919D4}: NameServer = 205.152.37.23,205.152.144.33
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL vwmkgb.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 7729 bytes

[integrinB4]

I've been having the same problem with Winweb Security popups.  I keep getting an array of Toolbar notifications from the red shield w/ the x in it.  They direct to Winweb Security.

I've tried the manul removals recommended for Winweb Security 2008, but none of the files or Registry Keys that many sites list are NOT in my registry and the files are not on my computer.

I did not WinWeb Security 2008.  

What I have I think is different than the Winweb Security 2008 problem that is highly written about.

It is just this stupid toolbar pop-up that directs to Winweb Security and a warning pop-up that wants me to download Winweb Security,  It gives a pop-up roughly every 2 minutes.  Highly Annoying.

[integrinB4]

So in looking at some solutions, I have found an errant file that should not be on my computer.  

It's creation dae and time is also the same time I suspect this download coming on my computer.

The icon is the red sheild with the x in it.
File location:
C;\Documents and Settings\All Users\Application Data\59FC55C9
It is an Application.  

I tried to delete it, but I cannot as it states that it is currently running.  I looked under the processes and found it, stopped it and then deleted permantly.

I also deleted this from the registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | {90BF8224-CD63-4081-A4C7-EF9A2CF6596F}
This was listed on another help site as associated with the Winweb Security problem as part of a new varient that has popped up over the week of November 28th through Dec 3rd 2008.

I am going to restart and verify that I have removed this toolbar popup completely.

[PatrickB]

I actually managed to get it off my toolbar using a similar strategy, I simply searched for all files created the day it popped up on my toolbar and happened to find a file with the exact same icon as the Winweb icon on my toolbar, which in my case was an orange shield with black stripes. The file was not named Winweb, it's title was just some random number "1497670966". I looked under task manager and killed the process with the same number "1497670966.exe". I then browsed up and deleted the folder - which happened to be labeled another random number "917868708" - containing this file and 1 or 2 .dll files. This folder was found in my AppsData folder under Documents and Settings as well. After restarting my computer the icon in my toolbar disappeared and I no longer received any annoying pop-ups, but I'm still having a few after effects such as my toolbar clock somehow being set to military time and my desktop keeps resetting to a blank screen whenever I reboot the computer. I fixed my clock back to what it was and now I'm going to run a few more scans with the many spyware tools I downloaded to see if I can remove the remnants of this virus.

[ronsue1979]

Hi Folks,
I am new to this forum.  The reason I came to be here is because I allowed WinWeb into my system. The good news is that SuperAntiSpyware remover took care of it in short time. I used the free version, but I think I will ujpgrade it. It only has a 3 & 1/4 check rating, but the review of it told a different story to me. You may wijsh to check it out.