Skip to main content
Microsoft Security Intelligence
Published Dec 03, 2009 | Updated Aug 22, 2017


Detected by Microsoft Defender Antivirus

Aliases: BKDR_HAMWEQ (Trend Micro)


Win32/Hamweq is a worm that spreads via removable drives, such as USB memory sticks. It contains an IRC-based backdoor, which may be used by a remote attacker to order the affected machine to participate in Distributed Denial of Service attacks, or to download and execute arbitrary files.
To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:
For more information on antivirus software, see
Additional remediation instructions for Win32/Hamweq
Disable Autorun functionality
Win32/Hamweq attempts to spread via removable drives on computers that support Autorun functionality. This is a particularly common method of spreading for many current malware families. For information on disabling Autorun functionality, please see the following article:
Follow us