Win32/Necurs
Microsoft security software detects and removes this family of threats.
This family of malware work together to download other malware, including threats from the Win32/Sirefef and Win32/Medfos families. They can also give a malicious hacker backdoor access and control of your PC.
These threats can be installed at the same time as rogue security software, such as Rogue:Win32/Winwebsec.
We have seen the Necurs family being installed by variants of the Blacole family, the Win32/Beebone family, the Win32/Zbot family, and the Win32/Dorkbot family.
Win32/Ganelp
Win32/Ganelp is a family of worms that spread via removable drives, upload stolen information and download arbitrary files onto your computer. They may masquerade as a legitimate Java update - however, they are in no way affiliated with Java and merely use the well-known name of Java to maliciously spread their copies.
Win32/Spycos
Win32/Spycos is a family of data-stealing trojans that captures your online banking credentials, such as account logon names and passwords. These trojans may send the captured information to the attacker by email, or may upload it to an attacker's FTP (File Transfer Protocol) site. It may also send spam emails employing social engineering techniques, in an effort to infect others.
Win32/Redyms
Win32/Redyms.A is a family of trojans that redirect search engine results that may pose as a fake Adobe Flash installer. In the wild, we have observed it being distributed by the Blackhole exploit kit.
Win32/Pirpi_
Win32/Pirpi is a family of backdoor trojans capable of allowing an attacker access and control of your computer.
Win32/Refeys
Win32/Refeys is a trojan that steals the passwords for your online banking accounts and bitcoin wallets. It can also log all of your keystrokes.
Win32/Foidan
Windows Defender detects and removes this threat.
The Win32/Foidan family can monitor and change how your Internet browser behaves.
Trojans in this family can get onto your PC when you download a file from the Internet. They can also be downloaded by other malware.
Win32/Grenam
Windows Defender detects and removes this threat.
This threat family consists of a trojan component that helps it run at startup (detected as Virus:Win32/Grenam.B!lnk), a worm component that spreads via removable drives (detected as Virus:Win32/Grenam.B!inf), and a virus component (detected as Virus:Win32/Grenam.B) that renames your executables.
Win32/Wysotot
Windows Defender detects and removes this threat.
This family of malware can do the following:
- Change your browser settings
- Download and run files, including other malware
It spreads through software bundlers and download managers, like GoPlayer Download Manager, that advertise free software or games.
Win32/Gamker
Windows Defender detects and removes this threat.
This family of trojans aims to steal financial information, SAP information, BitCoin wallets, and other sensitive information from an infected PC.It can also let a hacker to do other malicious actions on your PC and network.
Win32/Miuref
Windows Defender detects and removes this threat.
This family of threats are malicious JavaScript files that redirect your web browser to show you ads or download other malware.
They can be installed by other malware, including members of the Win32/Fareit family, or installed on your PC from a spam email attachment.
Win32/Cribit
Windows Defender detects and removes this threat.
This threat stops you from opening your files and displays a message, commonly called a "lock screen".
It tries to scare you into paying a fine to unlock your PC.
You can read more on our ransomware page.
Win32/Upatre
Windows Defender detects and removes this threat.
This program installs unwanted software on your PC without your consent.
Installation can include additional malware or malware components to an affected PC.
In the wild, we have seen this malware download updates of itself and variants of Win32/Zbot, Win32/Vawtrak, and Win32/Dyzap.
It can be installed by other malware. We have seen it arrive as an attachment to spam that is distributed by the Win32/Cutwail, Spammer:Win32/Hedsen, and W97M/Bartallex family.
Win32/Rovnix
Microsoft security software detects and removes this family of threats.
This malware family can download other threats onto your PC, such as Win32/Carberp and Win32/Vundo.
They can be installed on your PC by exploits, or other malware, such as Win32/Upatre.
We have seen new Rovnix variants exploit vulnerabilities addressed in CVE-2013-3660, CVE-2014-4113, and CVE-2015-1701.
Win32/Sefnit
Microsoft security software detects and removes this family of threats.
This family of threats can allow backdoor access, download files, and use your PC and Internet connection for click fraud and bitcoin and Litecoin mining.
Some Sefnit versions can monitor Internet Explorer or Mozilla Firefox to hijack search results when you use search engines such as Bing, Yahoo!, and Google.
They can be downloaded by other malware, or bundled with other software and downloaded through peer-to-peer file sharing networks.
Win32/Caphaw
Windows Defender Antivirus detects and removes this threat.
This malware family can give a malicious hacker access and control of your PC. Threats in this family can also try to steal your online banking details.
They spread via Facebook, Youtube, Skype, removable drives, and drive-by malware. When they spread via Facebook, they can posts on your wall. The post might look like this:
Win32/Bepush
Microsoft security software detects and removes this malware family.
This family of malicious browser extensions can post malicious links using your social media profile without your knowledge. They can also track which websites you visit and redirect you to malicious websites.
These threats mostly target Google Chrome and Mozilla Firefox.
They spread through links posted on social networking sites that redirect your web browser to malicious websites that can install malware onto your PC.
Win32/Emotet
Microsoft Defender Antivirus detects and removes this threat.
This threat can steal your personal information, including your banking user names and passwords.
It is usually installed when you open a spam email attachment or click on a malicious link in a PDF.
Learn how artificial intelligence in Windows Defender AV protects you from this threat before it even reaches your computer: How artificial intelligence stopped an Emotet outbreak
For information on defending enterprise environments from this threat, read: Mitigating and eliminating info-stealing Qakbot and Emotet in corporate networks
Win32/Autoac
Windows Defender detects and removes this threat.
Trojans are a type of malware that try to look innocent to convince you to install them on your PC.
They can steal your personal information, download more malware, or give a malicious hacker access to your PC.