Comments on: Winweb Security 2008

By: Charlie in FL

Charlie in FL — Tue, 23 Dec 2008 03:01:38 +0000

Hi Folks,
Can’t completely get rid of this nasty crap although I’m following the advice of Marty, Ideng & Don as best as I can-I reboot XP before I started, found the numbered executable file and killed it which stopped the pop-ups, searched and found 1 udb file which I dragged to recycle bin and emptied from there-Shut down computer and rebooted it but it all reappeared when windows loaded up-I again killed the numbered .exe file and stopped the pop-ups and after about 10 minutes the Icon in taskbar disappeared-Didn’t shut down & reboot computer this time in hopes of avoiding the reoccurence of that winweb crap-Any suggestions about how to
permanently resolve this -Thanks

By: Don in VT

Don in VT — Sat, 20 Dec 2008 12:37:37 +0000

Hi All,

Final Update, As I mentioned earlier I got rid of most but not all of the Winweb crap. What remained was a message that links to Microsoft regarding a remnant of Winweb still resided in my PC. You have all seen the message from MS that asks you to send the message on to MS? Well I did. I kept sending it on to them with an explanation of what the problem was and I guess they fixed it for me. I love those guys at MS. Anyway my PC is burning hot and clean and I am good to go. Best of luck to all you folks and again have a happy holiday season.

Don in VT

By: Don in VT

Don in VT — Fri, 19 Dec 2008 00:17:31 +0000

Hi Meme,

I followed the directions of Marty and ideng and pretty much got rid of the malware. I still have a problem but it is a lot better and I can live with the fix. When I did the file search I simply asked the search feature to look in all files,hidden as well, for .udb files. I got 2. I simply dragged them to my desktop and put them in the trash can and then empty the trash. They are now gone. I went to the task manager and found the 10 digit .exe file and ended that task. What I was left with is a start up message that indicates that there is still some remnant of the malware in my PC but again I will continue to work on the issue when I have time. Hope this helps.

Merry Christmas

Don

By: meme

meme — Wed, 17 Dec 2008 19:10:32 +0000

DOES ANYONE KNOW HOW TO GET RID OF WINWEB, IT IS NOT IN MY FILES I HAVE SEARCH FOR IT IN ALL FILES AND DOCUMENTS THE ONLY PLACE I HAVE FOUND IT IN IS TASK MGR AND I END TASK NOW BUT IT SEEMS TO REAPPEAR IF I GO INTO END PROCESS ITS NOT THERE!!!!!!!!!!!!HELP

By: Don in VT

Don in VT — Tue, 16 Dec 2008 12:10:18 +0000

Hi Again Everyone,

Well, thanks to your help and some work of my own I kinda sorta got the Winweb trash out of my PC. The pop ups are gone, the icon is gone but there is still something in there that gives me a warning when I boot up. I will drop you folks a note when I figure it out. One thing that was interesting, when I first blew away the #.exe and the .udb files, the PC went into a VERY slow mode until I did a full reboot (not a restart).

Keep in touch. Merry Christmas

Regards,

Don in VT

By: Don in VT

Don in VT — Tue, 16 Dec 2008 00:02:44 +0000

Hi Everyone,

I was wondering if anyone can tell me what exactly I type into the search line to get the hidden files ? When I go to task Manager I do find a 10 digit number with a . exe. Should I make that one go away ? From my research I understand the Winweb comes from Russia. Figures !! Any help would be appreciated.

Thanks,

Don

By: Carman Kendell

Carman Kendell — Sat, 13 Dec 2008 01:31:13 +0000

Martys instructions worked for me as well.

I should note that when I went into the Windows Task manager, the #.exe did not match the folder #. I deleted anyway. Icon disappeared after 10 minutes.

Cheers

By: Poker123

Poker123 — Sat, 13 Dec 2008 01:27:08 +0000

Marty’s suggestion worked for me. Took a while for the icon to disappear but all is well. Cheers

By: ideng

ideng — Thu, 11 Dec 2008 20:28:57 +0000

As BobApril pointed out, we’re probably dealing with the newer version of this nasty Winweb.

alexia, I think if you only killed the numbered process without clearing up your registry and/or removing Winweb’s numbered folder it will come back when you re-boot next time (hope I’m wrong here).

vduque, it seems you need to log in with admin account so the numbered folder can be removed. Without removing that folder or/and clearing up your registry the nasty Winweb will start to run again when you re-boot.

This is the worst malicious program I’ve seen so far. It does much more than popping up and asks you to download some software packages.

My computer was still infected and not functioning normally after I removed Winweb. Here is what I found: Google’s Chrome could not be used. It gave site not found error for any site. IE and Firefox worked but clicking any Google/Yahoo searching result link would lead to some strange site. Those are not the sites Google/Yahoo find for me. Those popular Malware removing software sites could not be viewed, such as http://www.lavasoft.com. Malware removal software downloaded from other computer
and copied to my infected one could not be installed. Finally, in my case, Window XP’s restore is disabled so I could not restore my old and clean system back.

The dangerous thing about all this is my computer looked functioning fine until I found all my Google/Yahoo searching result links go to strange sites.

Using Start->Accessories->System Tools->System Restore I could see my backups but Winweb disabled the restore process. I was really stock and ready to re-install my entire system. Then I found this site:
http://ezinearticles.com/?expert=Bob_Cheeseman

It has link to 3 part of Windows XP Recovery Console procedurals. Followed all the steps I got my computer back. That saved my day.

Who is responsible for Winweb????!!!!!!

By: vduque

vduque — Thu, 11 Dec 2008 09:53:42 +0000

I also tried the steps as Ian instructed, but it will not let me delete the numbered file, or the whole folder. It says I do not have permission. I got the icon to go away, but I still get pop-ups. Any help would be GREAT! This WinWeb deal is NO BUENO. Thanks so much!

By: BobApril

BobApril — Thu, 11 Dec 2008 03:35:13 +0000

There’s a new version of this that renames the executable and the folder to a random string of numbers. It also appears to block the download of your removal tool. Last, it makes sure the folders and files are “hidden” so they won’t appear in a default Windows search of the hard drive – you have to select to search hidden folders and files.

The new version also changed the registry key entries – I still found the one in “Run,” using that random number string, but could not find the classes and browser helper objects keys. On first reboot, it still seems to be gone – I’ll see if it stays uninstalled.

By: Alexia

Alexia — Thu, 11 Dec 2008 02:57:59 +0000

nevermind i just had to launch task manager and delete the only numbered file

By: Alexia

Alexia — Thu, 11 Dec 2008 02:53:12 +0000

Okay I tired looking for the files in serach and my laptop can never find anything i have Windows XP can someone help?

By: jonoldinho

jonoldinho — Thu, 11 Dec 2008 01:31:04 +0000

dudes just listen to martys and idengs advices and ur that winweb thing will go away. u guys deserve an oscar or something.
wooooohoooooooo

By: ideng

ideng — Wed, 10 Dec 2008 06:51:42 +0000

The following steps are what I used to remove winweb on my XP. Basically it’s what Marty described:
1. Using search. Make sure to click and expand the “more advanced options” tab then check the box to select “search hidden files and folders”. The search won’t find those 2 files without the above option selected.
2. In my case, config.udb and init.udb are under: documents and settings\all users\application data\926593267. Yours will have different folder name.
3. Under the numbered folder, besides these 2 .udb files, there is a file named with a number. In my case it’s called “2130920643.exe”. This is the winweb executable with the ugly icon.
4. Remove the numbered folder but write down the numbered file name.
5. As Marty described, launch task manager. Under process tab find the process that has the numbered file. Kill (end process) it. This step should stop winweb’s poping up and remove it from task bar.
6. Using “regedit” program and search for the number that is used to name winweb executable. In my case it’s the number 2130920643. Remove those entries (I found 2 of them).

Hope this helps.

-Ian Deng