Solved! Use WINWEB.EXE (Worm AMN) Removal Guide

I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:

Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.

WINWEB.EXE – Worm AMN removal

File MD5 Virus Alias
WINWEB.EXE 638c1c9a5cf3f8582811178187a646d2 Worm AMN
WINWEB.EXE 638c1c9a5cf3f8582811178187a646d2 Trojan, Suspicious File
WINWEB.EXE 638c1c9a5cf3f8582811178187a646d2 Worm Autorun
WINWEB.EXE 638c1c9a5cf3f8582811178187a646d2 Trojan Agent
WINWEB.EXE 638c1c9a5cf3f8582811178187a646d2 Trojan ZBot
WINWEB.EXE 638c1c9a5cf3f8582811178187a646d2 Rootkit SpyEye

WINWEB.EXE size: 569694 bytes
WINWEB.EXE hash: 638C1C9A5CF3F8582811178187A646D2

Created files:

%SysDir%\iconhandle.dll
%SysDir%\webad.dll
%SysDir%\winweb.exe
%Common AppData%\Apple Computer\Installer Cache\Safari 5.34.52.7\SetupAdmin.exe
%Startup%\bnebwisg.exe

Detected by UnHackMe:

WINWEB.EXE
Default location: %SYSDIR%\WINWEB.EXE

Dropper information:
MD5: 638c1c9a5cf3f8582811178187a646d2
File size: 569694 bytes

Leave a Reply