How to remove Winweb Security 2008 (Delete instructions)

Winweb Security 2008 is a rogue antispyware application. It being distributed through the spam, keygen sites and trojans. In all cases, reported that the computer is infected and that you must download and install the Winweb Security 2008 to clean your computer. During installation, Winweb Security 2008 configures itself to run automatically every time, when you start your PC.

Once running, Winweb Security 2008 starts scanning the computer and found a lot of trojans and spyware. Then, it said that you should purchase Winweb Security 2008 in order to remove them and protect your PC. Computer users are urged to avoid purchasing this bogus program!

Winweb Security 2008 generates false security alerts such as the following.

Winweb Security Warning
Your PC is still infected with dangerous viruses. Activate
antivirus protection to prevent data loss and to avoid the
theft of your credit card details.
Click here to activate protection.

Winweb Security Warning
Some critical system files of your computer were modified by
malicious program. It may cause system instability and data
loss.
Click here to block unathorised modification by removing
threats (Recommended)

These fake warnings may drastically slow the performance of your computer. Please ignore them. If you are a non-techie computer user then this method of removing Winweb Security 2008 and any associated malware from your computer is for you.

Symptoms in a HijackThis Log.

O2 – BHO: BHOws Object – {D5DF7C9D-6069-4552-8B0C-D02A912FC889} – ws.dll (file missing)
O4 – HKLM\..\Run: [adpws] “C:\Documents and Settings\All Users\Application Data\5689887B.exe”
O4 – HKLM\..\Run: [{90BF8224-CD63-4081-A4C7-EF9A2CF6596F}] “C:\Documents and Settings\All Users\Application Data\A974FA49.exe”
O4 – HKLM\..\Run: [WinwebSecurity] “C:\Documents and Settings\All Users\Application Data\WinwebSecurity\WinwebSecurity.exe”

Use the following instructions to remove Winweb Security 2008 (Uninstall instructions).

• Download and install HijackThis.
• Run HijackThis. Click on the Do a system scan only button.
• Look for these lines and place a checkmark against each of the following, if still present
  

  O2 – BHO: BHOws Object – {D5DF7C9D-6069-4552-8B0C-D02A912FC889} – ws.dll (file missing)
  O4 – HKLM\..\Run: [adpws] “C:\Documents and Settings\All Users\Application Data\5689887B.exe”
  O4 – HKLM\..\Run: [{90BF8224-CD63-4081-A4C7-EF9A2CF6596F}] “C:\Documents and Settings\All Users\Application Data\[RANDOM_NAME].exe”
  O4 – HKLM\..\Run: [RANDOM_NUMBERS] “C:\Documents and Settings\All Users\Application Data\[RANDOM_NUMBERS]\[RANDOM_NUMBERS].exe”
  O4 – HKLM\..\Run: [WinwebSecurity] “C:\Documents and Settings\All Users\Application Data\WinwebSecurity\WinwebSecurity.exe”

  Note: a few examples: [RANDOM_NUMBERS] – 764082672, 1612374962; RANDOM_NAME – 5828ADFF.exe, A974FA49.exe

• Click on Fix Checked when finished and exit HijackThis.
• Download Avenger from here and unzip to your desktop.
• Run Avenger, copy,then paste the following text in Input script Box:
  

  Registry values to delete:
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | WinwebSecurity
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | adpws
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | {90BF8224-CD63-4081-A4C7-EF9A2CF6596F}

  Registry keys to delete:
  HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\Browser Helper Objects\{D5DF7C9D-6069-4552-8B0C-D02A912FC889}

  Files to delete:
  C:\Documents and Settings\All Users\Application Data\5689887B.exe
  C:\Documents and Settings\All Users\Application Data\A974FA49.exe
  C:\Documents and Settings\All Users\Application Data\5828ADFF.exe

  Folders to delete:
  C:\Documents and Settings\All Users\Application Data\WinwebSecurity

  Then click on ‘Execute’.

• You will be asked Are you sure you want to execute the current script?. Click Yes.
• You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?. Click Yes.
• Your PC will now be rebooted.
• Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
• Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select “Perform Quick Scan”, then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

If you need help with the instructions, then post your questions in our Spyware Removal forum.