Win32/Winwebsec
Microsoft security software detects and removes this family of threats.
This family of rogue security programs pretend to scan your PC for malware, and often report lots of infections. The program will say you have to pay for it before it can fully clean your PC.
However, the program hasn't really detected any malware at all and isn't really an antivirus or antimalware scanner. It just looks like one so you'll send money to the people who made the program. Some of these programs use product names or logos that unlawfully impersonate Microsoft products.
Even if you do pay to "unlock" the app, it won't do anything because your PC isn't actually infected with all that malware it "found".
Different brands of the rogues may modify various settings on your computer, end or close programs or system services, or block access to websites.
by other malware.
You can read more on our rogue page.
SystemTool
EssentialCleaner
Essential Cleaner is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that he or she needs to pay money to register the software to remove these non-existent threats.
Win32/Winwebsec has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant's individual branding. The following details describe Win32/Winwebsec when it is distributed with the name "Essential Cleaner".
Warning: Win32/Winwebsec may stop affected users from running all but a short list of specified applications. This may have an adverse effect on security applications that would otherwise remove this malware. If your antivirus scanner is unable to remove this threat because of this behavior, please see the additional removal instructions below.
MSRemovalTool
MS Removal Tool is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that he or she needs to pay money to register the software to remove these non-existent threats.
Win32/Winwebsec has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant's individual branding. The following details describe Win32/Winwebsec when it is distributed with the name "MS Removal Tool".
Warning: Win32/Winwebsec may stop affected users from running all but a short list of specified applications. This may have an adverse effect on security applications that would otherwise remove this malware. If your antivirus scanner is unable to remove this threat because of this behavior, please see the additional removal instructions below.
PersonalShieldPro
Personal Shield Pro is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that he or she needs to pay money to register the software to remove these non-existent threats.
Win32/Winwebsec has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant's individual branding. The following details describe Win32/Winwebsec when it is distributed with the name "Personal Shield Pro".
Warning: Win32/Winwebsec may stop affected users from running all but a short list of specified applications. This may have an adverse effect on security applications that would otherwise remove this malware. If your antivirus scanner is unable to remove this threat because of this behavior, please see the additional removal instructions below.
SecuritySphere2012
Security Sphere 2012 is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform the user that he or she needs to pay money to register the software to remove these non-existent threats.
Win32/Winwebsec has been distributed with many different names. The name used by the malware, the user interface and other details vary to reflect each variant's individual branding. The following details describe Win32/Winwebsec when it is distributed with the name "Security Sphere 2012".
Warning: Win32/Winwebsec may stop affected users from running all but a short list of specified applications. This may have an adverse effect on security applications that would otherwise remove this malware. If your antivirus scanner is unable to remove this threat because of this behavior, please see the additional removal instructions below.
AVASoft Professional Antivirus
AVASoft Professional Antivirus is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform you that you need to pay money to register the software to remove these non-existent threats. It may also terminate processes and services, modify security settings, and block access to websites.
Antiviral Factory 2013
Windows Defender detects and removes this threat.
This rogue pretends to scan for malware and shows you fake warnings about malicious programs and viruses. It is designed to scare you into paying money to remove the fake threats by registering the software.
It can also close or stop programs, processes and services, modify security settings, and block access to websites.
It's a member of the Win32/Winwebsec family.
There is more information about this type of malware on our Rogue security software page.
Disk Antivirus Professional
Disk Antivirus Professional is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform you that you need to pay money to register the software to remove these non-existent threats. It may also terminate processes and services, modify security settings, and block access to websites.
System Care Antivirus
Windows Defender detects and removes this threat.
This rogue pretends to scan for malware and shows you fake warnings about malicious programs and viruses. It is designed to scare you into paying money to remove the fake threats by registering the software.
It can also close or end programs, processes and services, modify security settings, and block access to websites.
It is a member of the Win32/Winwebsec family.
There is more information about this type of malware on our Rogue security software page.
Antivirus Security Pro
Windows Defender detects and removes this threat.
This rogue pretends to scan for malware and shows you fake warnings about malicious programs and viruses. It is designed to scare you into paying money to register the program and remove the fake threats from your PC.
This threat can also stop your security software from running, change your security settings, and stop you from going to certain websites.
It is a member of the Win32/Winwebsec family.
You can read more about this type of threat on our rogue page.
Rogue:Win32/Winwebsec
Windows Defender Antivirus detects and removes this threat. See the Win32/Winwebsec description for more information.
SecurityShield
Rogue Antivirus programs are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software. Some of these programs may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products.
- Microsoft Security Essentials
- Windows Defender
- Microsoft Safety Scanner
- Microsoft Windows Malicious Software Removal Tool
Attentive Antivirus
Windows Defender detects and removes this threat.
Attentive Antivirus is a variant of Win32/Winwebsec - a family of programs that claims to scan for malware and displays fake warnings of "malicious programs and viruses". They then inform you that you need to pay money to register the software to remove these non-existent threats. It may also stop processes and services, modify security settings, and block access to websites.
SystemSecurity
Reports of Rogue Antivirus programs have been more prevalent as of late. These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software. Some of these programs may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products. These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.
WinwebSecurity
Reports of Rogue Antivirus programs have been more prevalent as of late. These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software. Some of these programs may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products. These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.
SecurityTool
Reports of Rogue Antivirus programs have been more prevalent as of late. These are programs that generate misleading alerts and false detections in order to convince users to purchase illegitimate security software. Some of these programs may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products. These products may represent themselves as “Antivirus XP”, “AntivirusXP 2008”, “WinDefender 2008”, “XP Antivirus”, or similar.
Rogue:Win32/InternetAntivirus
Windows Defender Antivirus detects and removes this threat. See the Win32/InternetAntivirus description for more information.
Rogue:Win32/Defmid
Windows Defender Antivirus detects and removes this threat. See the Win32/Defmid description for more information.