Removing an SMB worm from a Windows network

A worm that abuses Server Message Block (SMB) vulnerabilities can move rapidly between computers without requiring someone to open an attachment or click a malicious link. It commonly probes internal devices over TCP port 445, exploits unpatched systems, creates persistence, and attempts to copy itself to additional network shares.

The visible symptoms may include unusual network traffic, locked or missing files, disabled security tools, slow computers, unexpected administrator accounts, and repeated detections after an apparent cleanup. Treat these signs as a network-wide incident rather than an isolated infection.

The safest response is to contain the spread first, then investigate and clean affected devices in a controlled order. The instructions below are intended for authorized administrators and home users managing their own equipment.

Isolate the first suspected devices

Disconnect suspected computers from wired and wireless networks as soon as practical. Unplugging the network cable or disabling Wi-Fi is preferable to immediately shutting down a device because volatile evidence, running processes, and active connections may help identify the infection. If several systems are affected, use managed switch controls or firewall rules to restrict east-west traffic between workstations.

Avoid opening shared folders from an infected computer. Do not connect backup drives, USB storage, or clean administrative laptops until the system has been isolated. If ransomware activity is visible, disconnect storage targets and backup servers from the network while preserving existing files for later investigation.

Identify how the worm is moving

Review firewall, router, and endpoint security logs for repeated connection attempts to port 445. A single computer scanning many internal IP addresses is suspicious, especially when it contacts devices that do not normally communicate with it. Examine Windows Event Viewer, Microsoft Defender history, scheduled tasks, services, startup entries, and recently created local accounts.

Many serious SMB outbreaks have relied on vulnerabilities addressed by security updates such as those associated with MS17-010. This does not mean every SMB worm uses the same exploit, so confirm the affected operating system, patch level, and security software status before assuming the cause. Check NAS devices, printers, virtual machines, and Linux systems that provide SMB shares as well as Windows workstations.

Patch and disable exposed SMB features

From a known-clean administrator device, apply current operating system and firmware updates to every supported endpoint. Prioritize internet-facing systems, domain controllers, file servers, and computers that accept SMB connections. Replace unsupported Windows versions where possible instead of relying on antivirus detection alone.

Disable SMBv1 unless an essential legacy application requires it, and document any exception. Restrict TCP port 445 to trusted network segments through host firewalls and perimeter rules. File sharing should not be directly exposed to the public internet. On small networks, turning off Network Discovery and File and Printer Sharing on devices that do not need them can reduce the attack surface.

Action	Primary purpose	Timing
Disconnect infected hosts	Stops additional propagation	Immediately
Block unnecessary SMB traffic	Limits lateral movement	During containment
Patch operating systems	Removes known vulnerabilities	Before reconnection
Scan from trusted media	Detects malware and persistence	After isolation
Reset credentials	Prevents stolen-account reuse	After identifying exposure
Validate backups	Enables safe recovery	Before restoration

Clean compromised computers safely

Run a full scan with an updated security product after isolating each computer. If malware blocks normal tools, start Windows in Safe Mode or use a reputable bootable rescue environment created on a clean machine. Scan memory, system directories, scheduled tasks, services, browser extensions, startup folders, and removable media.

Do not delete suspicious files solely because their names look unfamiliar. Record file paths, hashes, detection names, and timestamps when possible. This information can reveal whether the worm is using a copied executable, a malicious service, a stolen administrative tool, or a scheduled task for persistence. If system files are damaged or the infection returns after multiple scans, wipe and reinstall the operating system from trusted media.

An SMB worm may arrive alongside other threats, including credential stealers, remote-access trojans, or unwanted browser software. If a cleaned computer displays altered search results, unfamiliar extensions, or changed page layouts, consult this adware cleanup guidance and investigate related browser changes separately.

Reset accounts and examine shared data

Change passwords for local administrators, domain users, VPN accounts, email accounts, and service accounts from a clean device. Use unique passwords and disable accounts that are no longer required. If a domain administrator account may have been exposed, rotate privileged credentials carefully and review domain controller logs for new accounts, group membership changes, and unusual logons.

Inspect shared folders for altered permissions, unfamiliar executables, ransom notes, and recently modified documents. Restore files only from backups created before the suspected compromise. Test a backup offline before returning it to production, and keep at least one protected copy that cannot be modified through ordinary network credentials.

Browser redirects or modified search settings can also indicate a separate browser hijacker rather than the SMB worm itself. Review the site’s browser hijacker guides when checking affected browsers, while continuing to treat unexplained network scanning as a separate security concern.

Confirm the network is clean

Re-enable connectivity gradually, beginning with patched and verified systems that have no unnecessary SMB exposure. Monitor DNS requests, authentication events, endpoint alerts, and outbound connections for several days. A device that immediately begins scanning internal addresses or creates new administrative activity should be isolated again.

Check that endpoint protection is active, definitions are current, and tamper protection is enabled where supported. Verify that firewalls block unsolicited inbound SMB traffic between workstation segments. Document affected devices, actions taken, indicators found, and the date of each validation step so recurring activity can be traced.

Reduce the chance of another outbreak

Use these practical safeguards as an ongoing baseline:

• Keep operating systems, routers, NAS devices, and endpoint security tools updated.
• Disable SMBv1 and remove unused file shares, accounts, and remote administration tools.
• Segment workstations, servers, guest devices, and backup systems with firewall rules.
• Require strong unique passwords and multifactor authentication for remote access.
• Maintain offline or immutable backups and test file restoration on a regular schedule.

An SMB worm can turn one unpatched computer into a path through the entire network. Isolate suspicious systems, patch every exposed device, reset potentially stolen credentials, and reconnect equipment only after scans and monitoring show that propagation has stopped. Begin the cleanup from a trusted device and preserve evidence before deleting files or rebuilding systems.