Microsoft security software detects and removes this threat.

This threat is the spreading component of the Worm:Win32/Gamarue family of worms.

Find out ways that malware can get on your PC.

Microsoft Defender Antivirus detects and removes this threat.

This malware family can give a malicious hacker control of your PC. The malware can also steal your sensitive information and change your PC security settings.

We've seen them installed by exploit kits and other malware. They can also be attached to spam emails.

Some variants of this family are worms and can spread by infecting removable drives (such as USB flash drives or portable hard disks). If you plug those drives into another PC, the worm will infect that PC as well. See Worm:Win32/Gamarue for more information.

On November 29, 2017, law enforcement agencies, in cooperation with Microsoft Digital Crimes Unit and with help from Windows Defender researchers, disrupted the Gamarue (also known as Andromeda). For more information:

Microsoft teams up with law enforcement and other partners to disrupt Gamarue (Andromeda)

Microsoft security software detects and removes this threat.

This malware family can give a malicious hacker control of your PC. The malware can also steal your sensitive information and change your PC security settings.

The Win32/Gamarue family description has more information.

Microsoft security software detects and removes this threat.

This threat can give a malicious hacker control of your PC to steal your sensitive information and change your PC security settings.

It can be installed on your PC by an exploit kit or other malware. It can also spread through spam email attachments, or installed through an infected removable drive, such as a USB flash drive.

See the Win32/Gamarue family description for more information.

Microsoft security software detects and removes this threat.

Worm:Win32/Gamarue is a family of worms that belong to the Win32/Gamarue family. The Gamarue family may be distributed by exploit kits, spammed emails or other malware, and has been observed downloading other files and stealing information about your computer.

Worm variants of the Win32/Gamarue family may spread by infecting removable drives (such as USB drives or portable hard disks) that you have plugged into your computer. If you then plug those drives into another computer, the worm will infect that computer as well.

See our infographic to for a depiction of how a worm spreads by removable drives.

For more information on this family, see the Win32/Gamarue description.

On November 29, 2017, law enforcement agencies, in cooperation with Microsoft Digital Crimes Unit and with help from Windows Defender researchers, disrupted the Gamarue (also known as Andromeda). For more information:

Microsoft teams up with law enforcement and other partners to disrupt Gamarue (Andromeda)

Microsoft Defender Antivirus detects and removes this threat.

This threat can give a malicious hacker control of your PC to steal your sensitive information and change your PC security settings.

It can be installed on your PC by an exploit kit or other malware. It can also be attached to spam emails, or arrive via an infected removable drive, such as a USB flash drive.

See the Win32/Gamarue family description for more information.

On November 29, 2017, law enforcement agencies, in cooperation with Microsoft Digital Crimes Unit and with help from Windows Defender researchers, disrupted the Gamarue (also known as Andromeda). For more information:

Microsoft teams up with law enforcement and other partners to disrupt Gamarue (Andromeda)

Microsoft Defender Antivirus detects and removes this threat.

This threat can give a malicious hacker control of your PC to steal your sensitive information and change your PC security settings.

It can be installed on your PC by an exploit kit or other malware. It can also be attached to spam emails, or installed through an infected removable drive, such as a USB flash drive.

See the Win32/Gamarue family description for more information.

Worm:Win32/Gamarue.A is a bot-controlled worm that spreads via removable drives. It gathers information about the infected computer and sends it back to a predefined remote web server, where it may accept further instruction and may lead to the installation of other malware.

This worm is a member of the Win32/Gamarue family that tries to steal information from your computer.

It arrives on your computer in a spam email and spreads via removable drives.

The worm sends information about your computer to a remote server. The server can then download more malware to your computer.

Worm:Win32/Gamarue.G is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new computers. Commonly, worms may spread directly by copying themselves to removable or network drives, or by attempting to exploit particular vulnerabilities on targeted computers. Worms also often attempt to spread via platforms that require user interaction in order to run. They may send themselves as an attachment to an email or an instant message, or send a link to a copy of themselves in the body of a message. In these cases the message needs to be convincing enough to encourage the victim to click on the link or attachment and run or download a copy of the worm.

Worm:Win32/Gamarue.K is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new computers. Commonly, worms may spread directly by copying themselves to removable or network drives, or by attempting to exploit particular vulnerabilities on targeted computers. Worms also often attempt to spread via platforms that require user interaction in order to run. They may send themselves as an attachment to an email or an instant message, or send a link to a copy of themselves in the body of a message. In these cases the message needs to be convincing enough to encourage the victim to click on the link or attachment and run or download a copy of the worm.

Windows Defender detects and removes this threat.

This worm can download files onto your PC.

It can be installed when you open a spam email attachment or downloaded onto your PC by other malware (such as Win32/Dofoil and Win32/Beebone) or from an exploit kit. It also copies itself to any USB flash drives connected to your PC.

Find out ways that malware can get on your PC.  

Windows Defender detects and removes this threat.

This worm can download files onto your PC.

It can be installed when you open a spam email attachment. It also copies itself to any USB flash drives connected to your PC.

Find out ways that malware can get on your PC.  

Microsoft Defender Antivirus uses the cloud and artificial intelligence powered by next-gen machine learning technologies to rapidly deliver protection against new and emerging malware.

This detection, made possible by cloud-based machine learning, defends against multiple types of emerging malware that perform various malicious actions on your PC.

Understand how malware can get on your PC

 

Our layered approach to intelligent, cloud-based protection employs a diverse set of machine learning models designed to catch the wide range of threats: from massive malware campaigns to small-scale, localized attacks. Read more: Small businesses targeted by highly localized Ursnif campaign 

Microsoft security software detects and removes this threat.

This threat is the spreading component of the Worm:Win32/Gamarue family of worms.

Find out ways that malware can get on your PC.  

Windows Defender detects and removes this threat.

This worm can download files onto your PC.

It can be installed when you open a spam email attachment or downloaded onto your PC by other malware (such as Win32/Dofoil and Win32/Beebone) or from an exploit kit. It also copies itself to any USB flash drives connected to your PC.

Find out ways that malware can get on your PC.  

Microsoft security software detects and removes this threat.

This threat can give a malicious hacker control of your PC to steal your sensitive information and change your PC security settings.

It can be installed on your PC by an exploit kit or other malware. It can also be attached to spam emails, or get in through an infected removable drive, such as a USB flash drive.

See the Win32/Gamarue family description for more information.

Microsoft security software detects and removes this threat.

This threat can give a malicious hacker control of your PC to steal your sensitive information and change your PC security settings.

It can be installed on your PC by an exploit kit or other malware. It can also be attached to spam emails, or gets in through an infected removable drive, such as a USB flash drive.

See the Win32/Gamarue family description for more information.