Microsoft security software detects and removes this threat.

This threat is the spreading component of the Worm:Win32/Gamarue family of worms.

Find out ways that malware can get on your PC.  

What to do now

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other hidden malware.

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

When run, Worm:Win32/Gamarue.N checks if you have the file desktop.ini in your PC.

If you do, this worm reads data from the file and runs it as code. This action is done as part of the spreading mechanism on removable drives used by Worm:Win32/Gamarue.N.

The file desktop.ini might be detected as Worm:Win32/Gamarue.O.

See the Worm:Win32/Gamarue family description for more information.

Analysis by Ray Roberts


The following could indicate that you have this threat on your PC:

  • You have the file desktop.ini in your PC


Alert level: Severe
First detected by definition: 1.143.2119.0
Latest detected by definition: 1.203.1578.0 and higher
First detected on: Feb 12, 2013
This entry was first published on: Feb 12, 2013
This entry was updated on: Nov 05, 2014

This threat is also detected as:
No known aliases