What is wwwpos32.exe?
wwwpos32.exe is usually located in the 'C:\Documents and Settings\dan.OFFICE\Start Menu\Programs\Startup\' folder.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Digital signatures [?]
wwwpos32.exe is not signed.
Folder name variants
wwwpos32.exe may also be located in other folders than C:\Documents and Settings\dan.OFFICE\Start Menu\Programs\Startup\. The most common variants are listed below:
- C:\Users\Ruben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Hashes [?]
| Property | Value |
|---|---|
| MD5 | aad81992e07d37ccada9ee5ce4809240 |
| SHA256 | 0a0a48ea668486913ab5566c5dcfdb35607c2e5f766da7b9f6b35103f7a48967 |
Error Messages
These are some of the error messages that can appear related to wwwpos32.exe:
wwwpos32.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
wwwpos32.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
wwwpos32.exe has stopped working.
End Program - wwwpos32.exe. This program is not responding.
wwwpos32.exe is not a valid Win32 application.
wwwpos32.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with wwwpos32.exe?
To help other users, please let us know what you will do with wwwpos32.exe:
What did other users do?
The poll result listed below shows what users chose to do with wwwpos32.exe. 91% have voted for removal. Based on votes from 314 users.
NOTE: Please do not use this poll as the only source of input to determine what you will do with wwwpos32.exe.
Malware or legitimate?
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
And now some shameless self promotion ;)
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
Danilo Selic writes
Just found this on a coworker's laptop.
Eset Nod32 also turned up a trojan called Win32/rootkit.agent.nsj in memory and asked to send two suspicious files to its headquarers for analysis. They are probably related.
We are scanning her hard drive and will post the results.
# 22 Jan 2010, 2:03
Danilo Selic writes
Nod32 found and was unable to open wwwpos32.exe in the startup folder of the current user. Freefixer found another suspect file, which we deleted, but did not notice wwwpos32.exe.
# 22 Jan 2010, 4:06
Edgar D writes
My wifes .exe programs couldn't be started. so I tried to find out the reason. Some worked, most don't. MS-Explorer ist still working. But no Highjackfree, Mozilla, Virusscanner. Even msconfig or regedit. In Protected mode they did and I found the wwwpos32.exe
Removing doesn't help. The exe files still do not run.
# 23 Jan 2010, 4:05
Pinky writes
I have it in the documents and settings\admin\menu start\programs\startup\wwwpos32.exe (84bytes)
Cant delete it from map, says its a windows essential
Its not detected by Avira nor SUPERantispyware...i could only deactivate it by CCleaner, otherwise it would ocupy 100%cpu with SVCHOST.EXE
What can I do?
# 23 Jan 2010, 7:24
Mark M writes
I just found this in my startup folder, Malwarebyte's and Spybot S&D haven't found it yet. Could I have a quick run down on how to delete it safely? I tried delete from the startup menu bar but it says it is in use by another program.
I'm getting large peaks in my CPU for svchost.exe as a symptom.
# 24 Jan 2010, 7:00
Pinky writes
Download Killbox and try to delete the file.
It worked for me, although i see it still in CCleaner's startup list, but as inactive, as I did before.
Goodluck
# 24 Jan 2010, 10:12
Mark M writes
I went to safe mode then deleted all the files as listed on this Romainian forum:
http://translate.google.com/translate?hl=en&sl=ro&u=http://www.faravirusi.com/2010/01/23/wwwpos32-exe-%25E2%2580%2593-cum-scap-de-el-solutie-pentru-devirusare/&ei=LHJcS42vGYX80wT2zqWrAg&sa=X&oi=translate&ct=result&resnum=7&ved=0CC0Q7gEwBg&prev=/search%3Fq%3Dwwwpos32.exe%26hl%3Den
Then used CCleaner to delete the registry entry. Seems to have worked so far
# 24 Jan 2010, 12:23
Michael G writes
wwwpos32.exe appears to be a rootkit
I got it and it would not delete from the DOS prompt, the explorer screen etc. I couldn't rename it, nor could I get it to not start through using MSCONFIG. It is a pretty tough customer.
So, here is how I went about it - no guarantee that it will work nor that it will be trouble-free for you.
This method requires that you have previously created a system restore point. Also that the restore point is of some value.
As the rootkit seems to have appeared around January 20, 2010, I went back a bit beyond that to give me some leeway.
I rolled back to an earlier version using System restore. As a result of doing this, I lost various settings, but I seem to have eliminated the rootkit. I am not clear how, but it seems to have worked. I had tried everything else I coud think of, but maybe one of them came into effect when I rebooted after the restore.
This is what I did:
Click Start, Programs, Accessories, System tools - you have to click it with the mouse button, not just land on it. Then it opens a menu that has as the bottom item System restore. Click that.
OR you can Run cmd and then run c:\windows\System32\restore\rstrui.exe
OR
Start>Programs>accessories>System Tools>system Restore.
Then choose "Restore my computer to an earlier time".
Pick a suitable date and let it run and follow the instructions.
Note: Read the warnings. It is not reversible.
All the best with it and don't do any of this unless you understand what you are doing. It is risky.
Michael
# 1 Feb 2010, 22:48
Wojciech writes
Hi,
My story: I went to a website of one company which was immadiately transfered to some Russian servers and suddenly my Avast went crazy. It was reporting one new virus after another. I thought it would never end. I left all of them for quarantine but later during a day my computer slowed down so much that I could do almost nothing. I couldn't use a printer or usb devices. I checked my ccleaner and I spotted this wwwpos32.exe on the autostart list (documents and settings\admin\menu start\programs\startup\wwwpos32.exe).
What I did:
- tried with Killbox but it couldn't move it
- I made a scan with Freefixer. It last like 6 hours but then it found www.pos32.exe and I removed it
- the problem with computer speed and usb devices was still unsolved so I restored my system for the day before the attack.
- I've read that it was a rootkit so I scanned comp. with rootkit revealer and it looks OK...
Thank you for your help!
# 3 Feb 2010, 13:24
Joseph C writes
Successfully removed wwpos32.exe:
Launched msconfig. Turned on Data Execution Prevention (via System Maintenance..Create Restoration Point..System Properties..Advanced Tab..Performance settings).
Turned off all systems and all startups. Restarted. Restart gave me error message that wwwpos32 couldn't start.
Used Windows Explorer to locate the file. Tried to delete (failed as expected) but got a register key {3AD05575-8857-4850-9277-11b85bd8e09} in the dialogue.
Used regedit to find and delete all (6 or so?) entries that contained this key.
Restarted in "select" mode. Found the file again and renamed it.
Returned to msconfig. Turned on start up options. Made sure wwwpos32 wasn't on the list, of course. Restarted again. Symptoms gone. Restarted again, this time with all services and startups on. All seems okay now.
# 4 Feb 2010, 15:29
Katherine writes
My computer is running SUPER slow. I mean, even my keyboard is typing slow, half the time, missing letters I type. I found this wwwpos in msconfig and tried almost every spyware removal progs to get rid of it, but it's still there.
I ran Freefixer and it just kept freezing on the scanning Autostart Shorcuts. I'd close it and get the "not responding" error message. I even let it run from 1pm to 9pm and it still didn't move from Autostart Shortcuts.
I got excited reading the above post because it looked promising. But alas, no luck. "wwwpos.exe" is still in the msconfig menu. When I turned off all systems & startups then rebooted, it just checked "load startups items" on it's own. It's a seriously tricky little bugger!
I also found aqusobogise.dll as a startup item. That's definately a bug too, it won't budge no matter what I do. I found it in the registry at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and rundll32.exe "C:\WINDOWS\aqusobogise.dll",Startup is in the Value Data. If I try and rename it just adds another in there and in msconfig Startup. It hides itself like wwwpos so the file can't be found. I googled the name but came up with a big fat nothing.
Can anyone help me with one or both of these tricky bugs?
# 5 Feb 2010, 7:16
Katherine writes
Sorry, I forgot one thing about the aqusobogise.dll. When I found it in the registry it is named "Odovububukuka" and "rundll32.exe "C:\WINDOWS\aqusobogise.dll",Startup" is in the data field.
I found nothing with Google.
# 5 Feb 2010, 8:39
Matt writes
After having read all of the comments here, and looked at a few other resources, I downloaded FreeFixer, scanned my files, and found and removed wwwpos32.exe.
Thanks a million for Ye're help, glad that this is gone now!
# 23 Feb 2010, 4:21
Roger Karlsson writes