Win32/Goweh threat description - Microsoft Security Intelligence

We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names

Published Feb 18, 2005 | Updated Sep 15, 2017

Learn about other threats

Detected by Microsoft Defender Antivirus

Aliases: Dowloader-GK (McAfee) TROJ_GOWEH (Trend Micro) Trojan.Digits (Symantec) Win32/Digits (CA)

Windows Defender Antivirus detects and removes this threat.

Trojan:Win32/Goweh is a Trojan that alters several settings in Internet Explorer, changing the default home page and redirecting search queries and traffic to other Web pages.

Use the following free Microsoft software to detect and remove this threat:

Microsoft Defender Antivirus for Windows 10 and Windows 8.1, or Microsoft Security Essentials for Windows 7 and Windows Vista
Microsoft Safety Scanner

You should also run a full scan. A full scan might find hidden malware.

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

When a Win32/Goweh variant runs, it copies itself to a location on the infected computer that is randomly selected from a list. It also copies itself to other random locations selected from another list.

The Trojan periodically downloads and installs updates as they become available from a certain Web site. The original instance of the Trojan then exits. The Trojan can also download a file from a Web site that contains commands and configuration settings.

The Trojan changes home page and search page settings in Internet Explorer to redirect traffic to other Web sites.

Later variants of this Trojan overwrite the Windows hosts file to prevent the user from accessing certain security and antivirus Web sites.

Prevention

Take these steps to help prevent infection on your PC.

The following can indicate that you have this threat on your PC:

Your Internet Explorer home page has changed to a page that you did not specify. In some cases you cannot change the home page to the original value.
Internet Explorer is accessing Web sites at a slower pace than normal.

Send us feedback

Tell us about your experience

Thank you for your feedback

Win32/Goweh

Summary

What to do now

Get more help

Technical information

Threat behavior

Prevention

Symptoms