Threat Description

Rogue: ​W32/Winwebsec


Category: Riskware
Type: Rogue
Platform: W32


Dishonest antivirus or antispyware software which tricks users into buying or installing it, usually by infecting a user's computer, or by pretending the computer is infected.


Automatic action

Once detected, the F-Secure security product will automatically block the suspect file from running and prompt the user to select a further desired action.

Excluding a file from scanning

If you are aware of and accept any potential risk associated with this program, you can configure the F-Secure security product to exclude it from scanning.

Suspect a False Alarm?

If you suspect a file has been incorrectly identified as malicious, (that is, it is a False Alarm or a False Positive), please first ensure your F-Secure security program is up-to-date with the latest detection database updates, then rescan the suspect file.

If you continue to suspect a False Alarm, you may submit a sample of the suspect file to our Security Labs for further analysis via the Sample Analysis System (SAS).

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

This is the detection for the Winwebsec family of rogueware.

Like most rogueware families, programs from the Winwebsec family will scan the computer system and then display fake alert messages stating that the system has been compromised. To deal with the supposed infections, the user is required to purchase a license to 'fully utilize' the program and/or 'enable' its disinfection functionality.


The downloader will download the full package of this rogue anti-malware program and install it onto the computer.


During installation, the program adds the following registry key to make sure it is always executed each time the computer is started:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SystemSecurity"="\"\\%filepath%\\SystemSecurity.exe\"

Description Created: 2009-03-11 06:13:59.0

Description Last Modified: 2009-03-23 08:56:53.0


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More