Published May 27, 2010 | Updated Sep 15, 2017


Severe |Detected with Windows Defender Antivirus

Aliases: Win-Trojan/Zbot.39424.B (AhnLab) Trojan-Clicker.Win32.Cycler.noj (Kaspersky) W32/Cycler.A (Norman) Trojan.CL.Cycler.AC (VirusBuster) Trojan horse Downloader.Generic9.ANFD (AVG) TR/Click.Cycler.nnd (Avira) Trojan.Downloader.Unruy.D (BitDefender) Win32/TrojanDownloader.Unruy.BC (ESET) Trojan-Downloader.Win32.Unruy (Ikarus) Downloader-BPA.e (McAfee) Trojan.Win32.Generic.51FA3DDB (Rising AV) Trojan-Downloader.Win32.Unruy.C (Sunbelt Software) TROJ_APPINIT.MCS (Trend Micro)


TrojanDownloader:Win32/Unruy.F is a trojan that downloads and executes arbitrary files, and can display advertising.
Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see
Enabling registry editor
This threat may modify the computer to prevent Registry Editor from running. To enable Registry Editor in your computer, please do the following:
  1. Run a command prompt. Click Start>Run and type cmd.
  2. In the command prompt, type the following as is and press Enter:
    reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
  3. Type exit at the command prompt.
Follow us