Rogue:Win32/Winwebsec is a family of programs that claim to scan for malware and display fake warnings of "malicious programs and viruses". They then inform the user that they need to pay money to register the software in order to remove these non-existent threats. Win32/Winwebsec has been distributed with several different names. The user interface varies to reflect each variant’s individual branding.

Note: Reports of Rogue Antivirus programs have been more prevalent as of late.  These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software.  Some of these programs, including Win32/Winwebsec, may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products. 

 

• Microsoft Security Essentials
• Windows Defender
• Microsoft Safety Scanner
• Microsoft Windows Malicious Software Removal Tool

Please refer to the individual subvariant encyclopedia entries listed below for symptoms displayed by different distributions of Winwebsec.

Rogue:Win32/Winwebsec is a family of programs that claims to scan for malware and displays fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats. This trojan may display a dialog that mimics the Windows Security Center. Some members of the Win32/Winwebsec family may also download additional malware and have been observed in the wild downloading variants of Worm:Win32/Swimnag, and Worm:Win32/Koobface.

Rogue:Win32/Winwebsec has been distributed with many different names. The user interface and other details vary to reflect each variant's individual branding. These different distributions of the trojan use various installation methods, with filenames and system modifications that can differ from one variant to the next.

Winwebsec distributions currently affecting users in the wild (as of March 2013):

AVASoft Professional Antivirus

Winwebsec distributions

Rogue:Win32/Winwebsec brands may use icons or user interfaces similar to the following:

Further reading

• Are you using the right "System Tool"?
• Slick links linked to slinky Winwebsec
• Winwebsec gang responsible for FakeMacdef?
• MSRT tackles another rogue

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

• Microsoft Security Essentials or, for Windows 8, Windows Defender
• Microsoft Safety Scanner
• Microsoft Windows Malicious Software Removal Tool

To remove the "MS Removal Tool" variant of this malware, refer to the Microsoft KB Article: How to remove the MS Removal Tool from your computer.