Skip to main content
Microsoft Security Intelligence
Published May 19, 2011 | Updated Sep 15, 2017


Detected by Microsoft Defender Antivirus

Aliases: No associated aliases


Windows Defender detects and removes this threat.

This family of worms can stop some programs from working and download files onto your PC, including other malware.

They spread by copying themselves to network shares and removable drives, such as USB flash drives. They can also spread though instant messages sent via instant messaging clients, such as MSN Messenger. 

Find out ways that malware can get on your PC.  

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other, hidden malware.

Be careful when sharing files

Windows has a feature that lets you share files and folders on a network or shared PC. This feature is sometimes abused by malware to spread to other PCs within the network.

You can get more information and tips on how to share files safely from these pages:

You should turn off file sharing until you make sure that all infected PCs have been cleaned of any malware.

Enable the registry editor

This threat might prevent Registry Editor from running. To allow the Registry Editor to run, follow these steps:

  1. Click Start then Run and type cmd to run a command prompt.
  2. In the command prompt, type the following and press Enter:
    reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
  3. Type exit.
Additional remediation instructions for this threat

This threat might make lasting changes to your PC's settings that won't be restored when it's cleaned. The following links can help change these settings back to what you want:

Enable MAPS 

Enable the Microsoft Active Protection Service (MAPS) on your system to protect your enterprise software security infrastructure in the cloud.

  1. Check if MAPS is enabled in your Microsoft security product:

    1. Select Settings and then select MAPS.

    2. Select Advanced membership, then click Save changes. With the MAPS option enabled, your Microsoft anti-malware security product can take full advantage of Microsoft's cloud protection service

  2. Join the Microsoft Active Protection Service Community
Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Follow us