Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
102 entries found. Displaying page 2 of 6.
Updated on Dec 24, 2021
Alert level: severe
Updated on May 02, 2015
Alert level: severe
Updated on Nov 16, 2022
Alert level: severe
Updated on Jun 14, 2023
Alert level: severe
Updated on Apr 17, 2014

Windows Defender Antivirus detects and removes this threat. See the Win32/Winwebsec description for more information.

Also detected as: TrojanDropper:Win32/Winwebsec(other),Trojan:Win32/Winwebsec(other)
Alert level: severe
Updated on Aug 24, 2011

Personal Shield Pro is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that he or she needs to pay money to register the software to remove these non-existent threats.

Win32/Winwebsec has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant's individual branding. The following details describe Win32/Winwebsec when it is distributed with the name "Personal Shield Pro".

Warning: Win32/Winwebsec may stop affected users from running all but a short list of specified applications. This may have an adverse effect on security applications that would otherwise remove this malware. If your antivirus scanner is unable to remove this threat because of this behavior, please see the additional removal instructions below.

Also detected as: Win32/Winwebsec(other),Rogue:Win32/Winwebsec(other)
Alert level: low
Updated on Oct 05, 2011

Security Sphere 2012 is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that he or she needs to pay money to register the software to remove these non-existent threats.

Win32/Winwebsec has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant's individual branding. The following details describe Win32/Winwebsec when it is distributed with the name "Security Sphere 2012".

Warning: Win32/Winwebsec may stop affected users from running all but a short list of specified applications. This may have an adverse effect on security applications that would otherwise remove this malware. If your antivirus scanner is unable to remove this threat because of this behavior, please see the additional removal instructions below.

Also detected as: Win32/Winwebsec(other),Rogue:Win32/Winwebsec(other)
Alert level: low
Updated on Apr 11, 2011
Security Tool is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
 
Special Note:
Reports of Rogue Antivirus programs have been more prevalent as of late.  These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software.  Some of these programs may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products.  These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.
 
Use Microsoft Windows Defender, Microsoft Security Essentials, the Microsoft Safety Scanner, or another up-to-date scanning and removal tool to detect and remove this threat and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.
Also detected as: Trojan:Win32/Winwebsec(Microsoft)
Alert level: low
Updated on Apr 02, 2013

AVASoft Professional Antivirus is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform you that you need to pay money to register the software to remove these non-existent threats. It may also terminate processes and services, modify security settings, and block access to websites.

Also detected as: Win32/Winwebsec(Microsoft)
Alert level: severe
Updated on Feb 20, 2013

Disk Antivirus Professional is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform you that you need to pay money to register the software to remove these non-existent threats. It may also terminate processes and services, modify security settings, and block access to websites.

Also detected as: Win32/Winwebsec(Microsoft)
Alert level: severe
Updated on May 03, 2011

Spammer:Win32/Fifesock.C is a component of Win32/Fifesock - a multiple component trojan family that injects code into Internet Explorer and Firefox in order to steal the user’s social networking credentials for sites such as Facebook, and then uses these credentials to send spam to their contacts. It may also download and execute arbitrary files. Some variants have also been observed to install rogue security software such as Rogue:Win32/Winwebsec.

Alert level: severe
Updated on Apr 11, 2011
TrojanDownloader:Win32/Chepvil.J is a trojan that attempts to download other malware from a remote server. In the wild, we observed this trojan downloading files detected as Rogue:Win32/Winwebsec, Backdoor:Win32/Cycbot.B and VirTool:Win32/Injector.gen!BG.
Alert level: severe
Updated on Apr 11, 2011
TrojanDownloader:Win32/Chepvil.I is a trojan that attempts to download other malware from a remote server. In the wild, this trojan was observed to download files detected as Rogue:Win32/Winwebsec, Backdoor:Win32/Cycbot.B and VirTool:Win32/Injector.gen!BG.
Alert level: severe
Updated on Apr 11, 2011
TrojanDownloader:Win32/Waledac.C is a trojan that downloads and executes arbitrary files.
Alert level: severe
Updated on Apr 11, 2011
System Security is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
 
Special Note:
Reports of Rogue Antivirus programs have been more prevalent as of late.  These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software.  Some of these programs may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products.  These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.
 
Use Microsoft Windows Defender, Microsoft Security Essentials, the Microsoft Safety Scanner, or another up-to-date scanning and removal tool to detect and remove this threat and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.
Also detected as: Trojan:Win32/Winwebsec(Microsoft)
Alert level: low
Updated on Apr 11, 2011
Winweb Security is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of “malicious programs and viruses”. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
 
Special Note:
Reports of Rogue Antivirus programs have been more prevalent as of late.  These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software.  Some of these programs may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products.  These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.
 
Use Microsoft Windows Defender, Microsoft Security Essentials, the Microsoft Safety Scanner, or another up-to-date scanning and removal tool to detect and remove this threat and other unwanted software from your computer. For more information on Microsoft security products, see http://www.microsoft.com/protect/products/computer/default.mspx.
Also detected as: Trojan:Win32/Winwebsec(Microsoft)
Alert level: low
Updated on May 22, 2014

Microsoft security software detects and removes this family of threats.

This family of malware work together to download other malware, including threats from the Win32/Sirefef and Win32/Medfos families. They can also give a malicious hacker backdoor access and control of your PC.

These threats can be installed at the same time as rogue security software, such as Rogue:Win32/Winwebsec.

We have seen the Necurs family being installed by variants of the Blacole family, the Win32/Beebone family, the Win32/Zbot family, and the Win32/Dorkbot family.

Find out ways that malware can get on your PC.

Alert level: severe
Updated on Apr 20, 2011

TrojanDropper:Win32/Hiloti.gen!A drops and installs several malware into the affected computer.

Alert level: severe
Updated on May 02, 2011

Spammer:Win32/Fifesock.G is a component of Win32/Fifesock - a multiple component trojan family that injects code into Internet Explorer and Firefox in order to steal the user’s social networking credentials for sites such as Facebook, Twitter and Blogspot, and then uses these credentials to send spam to their contacts. It may also download and execute arbitrary files. Some variants have also been observed to install rogue security software such as Rogue:Win32/Winwebsec.

Alert level: severe
Updated on May 02, 2011

Spammer:Win32/Fifesock.H is a component of Win32/Fifesock - a multiple component trojan family that injects code into Internet Explorer and Firefox in order to steal the user’s social networking credentials for sites such as Facebook, Twitter and Blogspot, and then uses these credentials to send spam to their contacts. It may also download and execute arbitrary files. Some variants have also been observed to install rogue security software such as Rogue:Win32/Winwebsec.

Alert level: severe