Microsoft security software detects and removes this threat.

This threat is a shortcut file created by variants of Worm:Win32/Gamarue. This malware family can steal information about your PC and download other malware.

What to do now

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find hidden malware.

Protect your sensitive information

This threat tries to steal your sensitive and confidential information. If you think your information has been stolen, see:

You should change your passwords after you've removed this threat:

Additional remediation instructions for this threat

This threat might make lasting changes to your PC's settings that won't be restored when it's cleaned. The following links can help change these settings back to what you want:

Disable Autorun

This threat tries to use the Windows Autorun function to spread via removable drives, like USB flash drives. You can disable Autorun to prevent worms from spreading:

Scan removable drives

Remember to scan any removable or portable drives. If you have Microsoft security software, see this topic on our software help page:

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Worm:Win32/Gamarue.gen!lnk is part of the spreading mechanism used by Worm:Win32/Gamarue, and is usually found on removable drives. The shortcut is used to invoke a Worm:Win32/Gamarue component, which might be detected as Worm:Win32/Gamarue.N.

If you click the shortcut, a worm detected as Worm:Win32/Gamarue.N will run.

See the family description Worm:Win32/Gamarue for more information.

Analysis by Ray Roberts


Alerts from your security software may be the only symptom.


Alert level: Severe
First detected by definition: 1.143.2119.0
Latest detected by definition: 1.201.906.0 and higher
First detected on: Feb 12, 2013
This entry was first published on: Feb 12, 2013
This entry was updated on: Dec 29, 2014

This threat is also detected as:
No known aliases