UDS:Monitor.Win32.WebWatcher removal

The UDS:Monitor.Win32.WebWatcher is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What UDS:Monitor.Win32.WebWatcher virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
Enumerates running processes
Expresses interest in specific running processes

How to determine UDS:Monitor.Win32.WebWatcher?


File Info:
name: 66702C58151ED6F81C4F.mlw
path: /opt/CAPEv2/storage/binaries/d32f983008b2d931a55a0a7b641e0851597f2eb53a67e252a44ec9dc4d48f7a6
crc32: BBFBEA74
md5: 66702c58151ed6f81c4f1cffab54f5ac
sha1: 8907024dfd79ab3d3491fd71d3bf13143437af51
sha256: d32f983008b2d931a55a0a7b641e0851597f2eb53a67e252a44ec9dc4d48f7a6
sha512: 33ba38f343c78c97874ea4f4002177ccfae9510631e2cf69a2d3b86cc2e290ce97c935a18c53bf04bde9a36800265eb9491e2be3d9222538476f1802ffaede90
ssdeep: 49152:IAouV6A+gCl20GWaAdfEWCkmt0HDozDQJ5aWsWPb8nYToxzn0p:tohAoiWaAdfEWCkmiHDuDQXNb8n+p
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T128D57BD3EBF184F1DCE500F520BA6F1B97769A40172181D3A366285CF91A3D019B7BEA
sha3_384: 995d1b8f75a4de8a9b22a943a216eeb9fe058772169c1ea7dba49145fd30ace1d0584e24b668bbab6368daed53a76c9b
ep_bytes: e842ee0000e941feffffb8cb665600a3
timestamp: 2020-05-27 05:21:29

Version Info:
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 8, 2, 55, 1203
InternalName: 
LegalCopyright: 
LegalTrademarks: 
OLESelfRegister: 
OriginalFilename: 
PrivateBuild: 
ProductName: 
ProductVersion: 8, 2, 55, 1203
SpecialBuild: 
Translation: 0x0409 0x04b0

UDS:Monitor.Win32.WebWatcher also known as:

Lionic	Riskware.Win32.WebWatcher.1!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38103504
FireEye	Generic.mg.66702c58151ed6f8
ALYac	Trojan.GenericKD.38103504
Cylance	Unsafe
K7AntiVirus	Unwanted-Program ( 004c3bea1 )
Alibaba	RiskWare:Win32/WebWatcher.76a23b38
K7GW	Unwanted-Program ( 004c3bea1 )
ESET-NOD32	a variant of Win32/Monitor.WebWatcher.F
Kaspersky	not-a-virus:UDS:Monitor.Win32.WebWatcher.gen
BitDefender	Trojan.GenericKD.38103504
Avast	FileRepMetagen [PUP]
Ad-Aware	Trojan.GenericKD.38103504
Emsisoft	Trojan.GenericKD.38103504 (B)
Comodo	ApplicUnwnt@#wo8uxxt0b2ck
McAfee-GW-Edition	Artemis
Sophos	WebWatcher (PUA)
Ikarus	Trojan.Win32.Skillis
GData	Trojan.GenericKD.38103504
Jiangmin	Monitor.WebWatcher.ka
Microsoft	Trojan:Win32/Wacatac.A!ml
McAfee	Artemis!66702C58151E
MAX	malware (ai score=88)
VBA32	BScope.Adware.WebWatcher
TrendMicro-HouseCall	TROJ_GEN.R002H07KP21
Rising	Malware.Heuristic!ET#93% (RDMK:cmRtazpvACwiTAUPMaDy+ZQhf/8e)
SentinelOne	Static AI – Suspicious PE
Fortinet	Riskware/WebWatcher
AVG	FileRepMetagen [PUP]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove UDS:Monitor.Win32.WebWatcher?

UDS:Monitor.Win32.WebWatcher removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X