How to remove a worm disguised as a Windows update

A fake Windows Update notification can be more dangerous than ordinary adware. A worm may use Microsoft-style colours, familiar wording and a convincing restart prompt to persuade someone to install a malicious executable. Once active, it can copy itself through removable drives, shared folders, email accounts or vulnerable devices on the same network.

This threat can appear on Windows 10 or Windows 11, including computers used at home, in a small business or on a school network. The alert may claim that an urgent security patch is required, even though genuine updates are delivered through Settings rather than an unexpected browser window.

Australian users should be especially cautious when a fake update appears while using public Wi-Fi in Sydney, Melbourne or Brisbane, or when working remotely over an NBN connection. Telstra, Optus and other internet providers do not install Windows patches through unsolicited pop-ups, and legitimate Microsoft notifications do not ask for cryptocurrency, gift cards or remote-access software.

Warning sign	Genuine Windows behaviour	Likely malicious behaviour
Delivery method	Settings > Windows Update	Browser pop-up, email attachment or unknown app
File request	No separate installer is normally needed	Downloads an .exe, .zip or script
Payment demand	Never requests payment	Asks for money, gift cards or cryptocurrency
Network activity	Uses Microsoft update services	Creates unusual shared-folder or USB copies
Restart message	Appears within Windows settings	Blocks the screen or demands immediate action

Recognising the deceptive update

The worm may use a file name such as WindowsUpdate.exe, SecurityPatch.exe or KB2025-Setup.exe. File names alone are not proof of safety because malware authors can copy the names of real Microsoft components. A notification appearing in Chrome or Edge, especially one with spelling mistakes, a countdown timer or an unfamiliar download button, deserves immediate suspicion.

Check whether Windows itself reports the update. Open Settings, select Windows Update and review the update history. Do not click the pop-up to verify it. If the alert appeared after visiting a streaming, torrent or free-download site, close the browser with Alt+F4 and avoid restoring its previous tabs.

Signs of infection can include slow logins, disabled security tools, unfamiliar startup entries, repeated USB-drive shortcuts and sudden network traffic. A worm may also create copies in mapped drives used by an office in Perth or a home NAS connected to a router.

Containing the infected device

Disconnect the computer from Wi-Fi or unplug its Ethernet cable as soon as practical. This limits communication with command-and-control servers and reduces the chance of the worm reaching other devices. Remove external USB drives, but do not open them on another computer until they have been scanned.

If the affected machine belongs to an Australian workplace, notify the administrator before deleting files or resetting passwords. This helps preserve useful evidence and prevents an employee from reconnecting an infected laptop to a company VPN. Home users should also disconnect shared printers, NAS devices and other computers temporarily.

Use a clean device to change important passwords, beginning with email, banking and cloud storage accounts. Enable multifactor authentication where available. If banking details were entered after the fake update appeared, contact the bank immediately; Australian customers can also report relevant scams to Scamwatch.

Removing the worm from Windows

Restart into Safe Mode if normal Windows operation is unstable or the malware repeatedly relaunches. In Windows 11, hold Shift while selecting Restart, then choose Troubleshoot, Advanced options, Startup Settings and Safe Mode. From there, run Microsoft Defender Offline or a reputable, fully updated anti-malware scanner. The malware removal guides provide additional background on handling suspicious Windows threats.

Before scanning, remove the fake installer from Downloads only if you can identify it confidently, and empty the Recycle Bin afterwards. Review Task Manager’s Startup apps and installed programs for entries added around the time of the alert. Check browser extensions as well, because a malicious add-on can recreate the notification after the main executable is deleted.

A full scan should cover local disks and connected removable media. Never approve a request to disable Defender, add broad antivirus exclusions or run an unknown “activation” tool. If the worm has modified system files, disabled security services or returned after several scans, back up essential documents without copying executable files and consider a clean Windows installation.

Checking shared folders and recovery options

After cleaning the primary computer, inspect other Windows devices and shared folders. Look for duplicated executables, shortcut files that hide the original folders and unfamiliar scripts. A separate guide on a network-share worm can help when the infection appears to be moving through mapped drives or office shares.

Do not reconnect every device at once. Scan each computer offline, update Windows from Settings and replace compromised USB media if it cannot be safely disinfected. Small businesses in Adelaide or Canberra should review access permissions so ordinary accounts cannot write broadly to shared directories.

File recovery requires care because the worm may have copied itself into backups. Use versions created before the infection and scan restored files before opening them. If the incident also involved encrypted or deleted data, guidance about cloud backup ransomware explains why backup accounts and synchronisation settings should be checked separately.

Preventing another fake update

Windows Update should remain configured for automatic updates, but updates must be obtained through Windows Settings or Microsoft’s official channels. Keep browsers, PDF readers and common utilities patched, since malicious advertising and compromised websites often deliver the first deceptive prompt.

Useful safeguards include:

• Use a standard Windows account for everyday work.
• Keep Microsoft Defender and its definitions updated.
• Disable automatic execution from removable media.
• Maintain offline or versioned backups.

Teach family members and staff that urgent pop-ups are not proof of a real security emergency. A genuine update does not require remote access through AnyDesk, TeamViewer or similar software, and Microsoft support does not cold-call Australians demanding payment.

After removal, monitor the computer for several days. Unexpected firewall alerts, recreated files or repeated login warnings indicate that another device or account may still be compromised. Treat a fake update as a wider security incident until every connected system has been checked.