UDS:DangerousObject.Multi.Generic: what the Kaspersky alert means and how to clear it

What UDS:DangerousObject.Multi.Generic is, and what it is not

UDS:DangerousObject.Multi.Generic is a verdict from Kaspersky's cloud, not the name of one virus, one trojan or one ransomware family. Kaspersky's own threat page says it is used for samples that were "not classified exactly", so the name alone cannot tell you what is on your PC, or whether anything is.

1. 1

   What the name is

   Kaspersky names a detection as a prefix, a behaviour, a platform and a family. Here the prefix is UDS, the behaviour class is DangerousObject, the platform is Multi (more than one) and the family slot holds the word Generic. Together they say: the Kaspersky cloud judged this file dangerous and could not file it under a named family.

2. 2

   What Kaspersky says about it

   The threat page for DangerousObject.Multi.Generic reads: "Malicious software is detected by KL Cloud Technologies. This verdict used for samples which was not classified exactly." It gives no payload, no behaviour and no removal advice, because there is no single threat behind it.

3. 3

   What it is not

   Our 2020 guide opened with "the heuristic detection name for dangerous ransomware or trojan". That was wrong on two counts: a heuristic verdict comes from a program's local analyzer, while this one is a cloud verdict, and it names neither ransomware nor a trojan. Files that carry it range from real droppers to a game's own executable.

4. 4

   Why people see it so often

   Kaspersky's 2013 statistics report put DangerousObject.Multi.Generic first in the Top 20 of objects found on users' computers, at 27.8% of affected users. It is the verdict the cloud gives when no signature and no heuristic exists yet, so a brand-new file, real or harmless, is where it appears.

Shown by

Kaspersky products. The 2020 pictures show it on Windows and in a Russian-language phone alert

Spelling in alerts

UDS:DangerousObject.Multi.Generic; a 2013 forum post wrote UDS.DangerousObject.Multi.Generic; our 2020 guide quoted UDS:Dangerous.Object.Multi.Generic

Source of the verdict

Kaspersky's cloud technologies (the Kaspersky Security Network, KSN), not a local signature

Is it one program?

No. In the cases we read it sits on game launchers, a PUP installer, a Java cache file and a file that 52 of 68 engines flagged

Not the same as

HEUR: and PDM: detections, which come from Kaspersky's heuristic analyzer and proactive defense module

So the useful questions are which file triggered the alert, where it came from and whether it ran. The chapters below help you answer them before you delete, restore or exclude anything.

How to read the name, part by part

Kaspersky's naming rules build a name as [Prefix:]Behaviour.Platform.Name[.Variant]. Here is UDS:DangerousObject.Multi.Generic split up.

What we checked on 6 October 2026, and what we could not

There is no website here to test and we ran no sample. We read Kaspersky's own pages and forum threads that list the name, and we ran nothing on a PC.

Files that carried the name: real and false alarms

These are the cases we could read. They show how different the files are, and they are not a list of what your alert is.

Our 2020 guide listed UnclassifiedMalware and Trojan.Script.Suspic.gen next to Win32:Dropper-gen, Trojan.Dropper.URN and Trojan.DownLoader7.15504 as the common companion names. The last three are visible on the VirusTotal picture. We found no source for the first two, so we call them not confirmed. The lesson of the picture holds: read every name in the scan report, because the second or third name is often the one that identifies the family.

How the name has turned up, 2013 to 2026

Our 2020 guide said reports began in 2018 on the Steam forum. The oldest page we read is from 2013, and Kaspersky's statistics put the verdict first in 2013.

1. 2013

   The most common verdict in Kaspersky's statistics

   Kaspersky Security Bulletin 2013 ranks DangerousObject.Multi.Generic first among the objects found on users' computers, at 27.8% of affected users, and says the Urgent Detection System had given over 11 million computers real-time protection.

2. 1 Jun 2013

   A Windows XP user posts on BleepingComputer

   Kaspersky Internet Security 13 flagged a file in the Java cache folder. The user's fix, posted two days later, was to empty the Java cache and rescan.

3. 1 Jun 2020

   Our first guide

   The 2020 guide treated the name as a possible trojan or ransomware and showed Kaspersky alerts, in Spanish and Russian, together with the VirusTotal list shown above.

   

4. 18 Jun 2020

   A PUP posing as a Windows updater

   A Kaspersky moderator tells a user that Windows Updater.exe in an AdvancedWindowsManager folder is not the Windows tool and that the program is a potentially unwanted application.

5. Nov to Dec 2020

   Two game launchers flagged

   SpaceEngineers.exe on 18 November and Blizzard's Bnet.exe on 11 December are flagged, and a Kaspersky responder later says Bnet.exe is no longer detected.

6. 29 Aug 2021

   A Steam game's crash uploader

   A user reports a deleted file from a Steam game. The moderator's advice is a full scan, a check of browser extensions and a re-check on Kaspersky's Threat Intelligence Portal.

7. 27 Feb 2024

   A VPN client on GitHub

   An issue on the Hiddify repository reports Kaspersky flagging Hiddify.exe and quotes a Kaspersky reply that its applications classify the objects as legitimate.

8. 28 May 2025

   A game update trips it

   An update to Into the Dead: Our Darkest Days is flagged. The developers report it and Kaspersky answers that the detection was false.

9. 3 Jun 2026

   Kaspersky's false-detection page is updated

   Kaspersky's article on false detections was last updated on this date. It tells users to update the databases, keep the cloud connection active and submit the object for reanalysis.

What the alert shows, and what to do about it

The detection name is only a clue. The path, the source and whether the file ran decide what to do. Open your Kaspersky app's report of detected objects and read these before you click anything.

What a real hit can cost you, and what a false one can

If the file is a real trojan, the damage is that of the trojan. If it is a false positive, the harm is a deleted file and a broken program. Our 2020 guide listed only the first kind.

• High

  Stolen logins and banking data

  Our 2020 guide said a dangerous trojan can harvest banking information, saved passwords and browsing history. That is a general trojan risk. The VirusTotal sample in our picture was flagged as a dropper and downloader, which fetches other programs.

• High

  Spying

  The 2020 guide listed key logging, camera use and regular screenshots. No source ties these to the name itself, but they are what a real banking or spying trojan does, which is why a real alert needs a full cleanup and new passwords.

• High

  A backdoor and a route to ransomware

  The 2020 guide listed backdoor access that can lead to ransomware or other infections, administrator rights that let the attacker manage the PC, and a connection to a command server run by the attacker. These are general trojan behaviours, not found in a source for this name.

• Medium

  A weakened PC

  The 2020 guide said a trojan can weaken the PC's security, insert entries in system folders and block software. A real infection can leave the system damaged after the file is gone, so a scan after removal is advised.

• Medium

  Ransomware

  The 2020 guide said the detection may refer to ransomware, with locked files, a ransom note and a lock screen. Kaspersky's page does not say so, and we found no case where the name led to encrypted files. If you see renamed files and a note, that is a different and urgent problem.

• Medium

  A game or program that stops working

  In the SpaceEngineers.exe case Kaspersky quarantined the launcher and Steam then reported the file missing. A false positive on a program you need costs you the program until you restore or repair it.

• Low

  Nothing at all

  A false positive does no harm to your data. The Bnet.exe alert later stopped, and the 2025 game alert was answered by Kaspersky as false. The danger is the case you cannot tell apart yet, so check the file before you decide.

What you may notice, and what the sources show

Our 2020 guide said a trojan can make the system sluggish, leave software idle or even crash it, and that some malware runs for a long time before any sign shows. The alert comes from your own antivirus, usually when it scans a file or you open or download one.

How a file like this gets onto a PC

No source we read says how an alert for this name arrives. The cases show two kinds of arrival: an update to software you chose, and the usual routes of a trojan.

1. 1

   An update to software you installed

   Two of the cases, the 2021 and 2025 Steam ones, came with a game update. The moderator's own words in the SpaceEngineers.exe thread were that an update may have changed the file so that it is now detected. Our 2020 guide named CPU-Z updates and GameHouse games. The CPU-Z Portable download appears in its picture, and we did not find a source for GameHouse.

2. 2

   Cracks, keygens and shady download sites

   Our 2020 guide said the name is usually connected to cracks and keygens, and that applications downloaded from shady sites can be trojans in disguise. The sources we read do not show a crack case, but these are the routes on which droppers like the VirusTotal sample arrive.

3. 3

   Email attachments and macros

   The 2020 guide listed malicious spam attachments. A file you did not expect, or a document that needs macros enabled before it will open, is a sign of an attack.

4. 4

   Fake update prompts and random links

   Links on random sites or social media and pop-ups saying software needs an update are the other routes the 2020 guide named. If you clicked one, more unwanted programs can follow.

5. 5

   A program that came with something else

   The Windows Updater.exe case was a PUP that sat in a program folder of its own. Programs installed with other software bring their own files, and the alert can be the first sign.

Whichever the route, well-made malware runs in the background and takes steps to avoid detection, as the 2020 guide said. That is why the first sign is often only the alert.

Check your PC before you delete anything

Do not click Delete, Skip or Add to exclusions in the pop-up until you have written down what the alert says. Our 2020 guide told readers to ensure the security tool has the latest definitions and run a scan, and that is still the first step.

1. 1

   Update Kaspersky's databases

   Kaspersky's article on false detections says that if the databases were last updated more than 4 to 6 hours ago, you should update them again to reduce the chance of a false positive. Do this first, then open the alert again.

2. 2

   Check the cloud connection

   The same article says that if you use Kaspersky Security Network you should make sure its connection is active. This verdict comes from that cloud, so a missing connection changes what you see.

3. 3

   Copy the alert

   Take a photo or screenshot. A Kaspersky moderator asked a user to open the app's Reports, go to Detected Objects and upload the report with the full path of the file. Note the file name, the folder, the time and the program that started it.

4. 4

   Ask where the file came from

   Did a game or a program update, did you open an email attachment, or run a crack, just before the first alert? A file in a game's own folder after an update is the false-positive pattern in our cases. A file in Downloads or Temp from an unknown source is the other.

5. 5

   Look at the publisher

   In File Explorer right-click the file, choose Properties and look for a Digital Signatures tab. A valid signature from a publisher you know is a good sign. It is not proof, because signed malware exists.

6. 6

   Check the file on Kaspersky's portal

   Kaspersky tells users to check a suspect file, hash, address or link on the Kaspersky Threat Intelligence Portal (opentip.kaspersky.com). Upload only a file you are not worried about leaking: a personal or work document does not belong there.

7. 7

   Look at what starts with Windows

   Press Ctrl + Shift + Esc, open Startup apps and note names you do not know. Open Settings > Apps > Installed apps and sort by install date to see what arrived recently.

8. 8

   Read every name in the report

   Open the scan report and write down every detection, not only this one. A second name beside it, such as Trojan.Dropper or Win32:Dropper-gen, often identifies the family.

Remove it from Windows 11 and Windows 10

Do the steps in order and stop when a scan from outside normal Windows is clean and the alert has not returned. Our 2020 guide said manual removal cannot be done, because the detection is not tied to one infection. That is half right: you cannot hunt for a family of this name, but you can remove the file it flagged and the programs that came with it. We did not run these steps on a live infection; they follow Microsoft's pages and Kaspersky's own advice.

1. 1

   Disconnect, then back up documents

   Turn off Wi-Fi or unplug the cable. Copy documents and photos, not programs, to an external drive that you unplug afterwards. If files are encrypted and a ransom note is on screen, skip to the note in the account chapter.

2. 2

   Start in Safe Mode with Networking

   On Windows 11 open Settings > System > Recovery and click Restart now beside Advanced startup. On Windows 10 open Settings > Update & Security > Recovery. Then choose Troubleshoot > Advanced options > Startup Settings > Restart, and on the Startup Settings screen press 5 or F5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows with only essential services and drivers, and that Safe Mode with Networking adds the network drivers you need to get online. Our 2020 guide said to scan from here so a malicious process cannot block the scanner.

3. 3

   Run a full scan in your Kaspersky app

   Close other programs and run the full scan, with the databases updated. Do not use the computer while it runs, as a Kaspersky moderator advises. Keep what it finds in quarantine. Our 2020 guide said that if the scan ends with a real malware detection you should quarantine all the entries at once.

4. 4

   Run a second opinion with Microsoft Defender Offline

   Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and click Scan now. Microsoft says it runs from a trusted environment outside the normal Windows kernel, which helps against malware that hides in Windows. Then open Protection history to read the result.

5. 5

   Uninstall what you do not know

   In Settings > Apps > Installed apps remove programs that came with the file or that you did not install, the way the Windows Updater.exe case was handled. Then check Startup apps in Task Manager again.

6. 6

   Clear the Java cache if Java is installed

   Our 2020 guide said that cleaning temp files and clearing the Java cache removed the detection for some users, and the 2013 case agrees. Open the Java Control Panel, click Settings under Temporary Internet Files on the General tab, click Delete Files and then OK. Oracle's page covers Java 7 and 8, so skip this if Java is not on the PC.

7. 7

   Try System Restore if the alert began after an install

   Press Windows logo + R, type rstrui.exe and choose a restore point from before the install. Microsoft says System Restore reverts system files, registry settings and installed programs, and leaves personal files alone. It will not help if no restore point exists.

8. 8

   Update Windows and your security product

   Install every update under Settings > Windows Update and update Kaspersky. Then scan again. A product with old databases may flag a good file or miss a bad one.

9. 9

   Check the repair after removal

   Our 2020 guide said a trojan can delete registry entries and core system parts, so check the system once the file is gone. Run Windows Security's scan, install pending updates and open the programs you use. If a system file is damaged, Reset this PC is the last resort.

10. 10

    Last resort: reset Windows

    Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything. Restore only documents, no programs and no full system image.

Never download a removal program because a pop-up, a stranger or a phone number tells you to. A real threat does not need a payment page to fix. We name no product as a remover, and no scan can promise to remove every trace of a trojan.

Could it be a false alarm?

Possibly. Our 2020 guide said that if the alert keeps returning after a thorough scan with other engines, a false positive is likely. The cases back that up, but a quiet second scan is still one data point. Only Kaspersky can confirm a false positive.

1. 1

   Submit it for reanalysis

   Kaspersky's page says to check the object on the Kaspersky Threat Intelligence Portal, click Submit to reanalyze on the results page, enter your email address and a comment, then click Submit. Describe how you got the file, what it should contain and why you checked it. The portal asks you to use a different browser or incognito mode if the upload fails.

2. 2

   Open a support case if it persists

   Collect the version of your Kaspersky app, the database release date, whether KSN is on, the text of the alert and how you got the file. If you send the file, put it in an archive with the password infected. A Kaspersky moderator in 2021 asked users to zip the file, name the archive malware or infected and protect it with a password.

3. 3

   Repair a game that lost a file

   If Kaspersky deleted a game's file and Steam reports it missing, open the game's Properties in your Steam library, choose the Installed Files tab and click Verify integrity of game files, as Steam Support describes. Do this only after Kaspersky has cleared the file, or it may delete it again.

4. 4

   Use an exclusion last

   In the Bnet.exe case, ignoring and excluding did not stop the alert, and the alert ended later, when a Kaspersky responder said the file was no longer detected. An exclusion hides a real threat as well as a false one, so use it only after Kaspersky or a check you trust says the file is clean.

If the alert is on an Android phone

Our 2020 guide said an Android version of this virus is tied to a malicious java.exe file. That cannot be right: java.exe is a Windows program file, and Android has no such file. What the 2020 picture does show is a phone alert, in Russian, that names UDS:DangerousObject.Multi.Generic and asks whether to delete an app.

1. 1

   Note which app the alert names

   On the phone the alert is about an installed app, not a Windows file. The alert in our picture reads that viruses were found and asks to delete the app. Write down the app's name and when you installed it.

2. 2

   Do not install anything to clear it

   Do not install a cleaner or an antivirus from a pop-up, an ad or a message. Use the Google Play Store and the security app you already have.

3. 3

   Run Google Play Protect

   Open the Google Play Store, tap your profile icon at the top right, tap Play Protect and then Settings, and make sure Scan apps with Play Protect is on. Google says Play Protect checks apps when you install them and scans the device periodically. If it finds a potentially harmful app it can send a notification, with an Uninstall option, disable the app until you uninstall it, or remove it automatically.

4. 4

   Remove an app you do not know

   Open Settings > Apps, find the app the alert named and choose Uninstall. Menu names differ between phone makers. We did not test these steps on a phone.

5. 5

   If it is an app you trust

   If the alert names an app from a developer you know and it came from Google Play, treat it as a possible false positive and report it to Kaspersky through your security app or Kaspersky support. We found no write-up of an Android case, so we cannot say how often this happens.

6. 6

   Change passwords if you entered any

   If you signed in to an account inside the app, change that password from another device.