Cleaning up a worm that spreads through network shared folders

In plenty of Brisbane and Melbourne small offices, documents live on a NAS tucked beside the printer or on a Windows server everyone maps as the "S:" drive. The moment a worm reaches one of those workstations, it scans every reachable share for writeable paths and quietly drops copies of itself, often disguised as .scr or double-extension files such as report.pdf.exe. Once it has seeded every public folder on the practice server, anyone who opens a file remotely can re-trigger the payload, which is why a single scan rarely finishes the job. The replication loop has to be broken at the source before shared folders can be trusted again.

This walkthrough focuses on worms that propagate through SMB shares rather than email links, and assumes you are working on a Windows 10 or Windows 11 PC connected through an NBN modem to a typical Australian office LAN, perhaps behind a Telstra-supplied router. The aim is to stop the spread between machines, scrub the shared paths, and remove the autorun hooks that let the same infection come back on the next reboot.

Recognising the early indicators of a network worm

A worm on shared drives rarely announces itself with a ransom note. Instead, you notice that opening the "Projects" share from the Surry Hills office takes ten times longer than it did on Monday, or that your finance drive in Parramatta keeps dropping connection mid-save. Other tell-tale signs include executable files appearing with names that mimic legitimate documents, a sudden spike in failed login attempts as the worm tries weak credentials across the subnet, and Task Manager showing several instances of svchost.exe or rundll32.exe eating CPU even though nothing heavy is open.

Symptom observed	Likely cause	Where to look first
New .exe files in mapped shares	Worm payload dropped into shared folders	Sort the share by Date Modified
Shared folders become very slow	Mass file scan or encryption prep	Resource Monitor, Network tab
Repeating failed logon alerts	Worm brute-forcing SMB accounts	Windows Security, Account logon events
Hidden autorun.inf on USB sticks	Worm spreading via removable media	attrib -h -r -s autorun.inf
Hijacked default search engine	Secondary payload installed by dropper	Browser settings, Startup tab

If several of these appear together, treat every host that has touched the share as suspect and move straight into containment.

Isolating the infected workstation from the LAN

Before any cleaning tool is run, the affected PC has to be pulled off the network so it cannot write fresh copies back to the share while you are still working on it. The fastest method is to yank the Ethernet lead and disable Wi-Fi from the system tray, which suits a quick fix at a home office in Fremantle or a coworking desk in Adelaide. For laptop users who roam between branches, set the device to airplane mode and forget all saved Wi-Fi profiles until the disinfection is finished.

Once offline, open an elevated command prompt and run gpupdate /force followed by a manual review of network adapters in Device Manager to make sure nothing automatically reconnects. If the router on site supports per-device blocking, log into the admin console and add the infected MAC address to a deny list as an extra layer. Avoid booting into Safe Mode with Networking for worm cleanup, because keeping the network stack loaded allows the worm to reach any share that is still mapped when you least expect it.

Cleaning mapped drives and shared folders

With the workstation isolated, list every current share mapping by typing net use and note which drive letters point to infected servers. Drop them all with net use * /delete /y so nothing reconnects after a reboot. From a clean USB stick loaded with a portable scanner such as ESET Online Scanner or Malwarebytes, run a full scan of the local profile folders, focusing on AppData, the Desktop, and any download directories that might have staged the original dropper. For broader Windows hygiene and hardening tips that complement this process, the Windows tips and tricks section has a useful checklist.

After the local scan, mount each shared folder one at a time from an uninfected machine and search for recently modified executable files, paying attention to anything that matches the pattern *doc.exe, *report.scr, or files with the hidden attribute. Delete those payloads, remove any autorun.inf or RECYCLER folder entries, and reset share permissions to deny write access for accounts that do not genuinely need it. Keep the share offline from the cleaning PC for at least one reboot cycle so a latent copy on another workstation cannot reinfect the freshly scrubbed folder.

Killing scheduled tasks, services, and registry persistence

Worms that survive a reboot usually do so through scheduled tasks, modified services, or WMI event subscriptions that re-launch the payload every hour. Open Task Scheduler and review the library for anything pointing to a Temp folder, a RECYCLER path, or a random hash-looking filename, then disable and delete those entries. Inside the registry, check HKLM\Software\Microsoft\Windows\CurrentVersion\Run, the RunOnce keys, and the Winlogon Shell value, removing any reference to executable files stored outside Program Files.

Some samples also drop a secondary component that resets browser settings and pushes search traffic through a proxy, which is why a routine cleanup that ignores the browser can still leave the user feeling followed around the web. For a focused pass on those payloads, the browser hijacker removal guides cover the leftover survey screens and homepage locks that often follow a worm infection. Finish by clearing the WMI repository with mofcomp resets only if you are comfortable doing so, otherwise rely on a reputable stand-alone removal tool.

Hardening share permissions after the cleanup

Once the immediate threat is gone, the LAN needs tightening so the next dropped attachment cannot ride the same path. Disable SMBv1 on every server and NAS, force SMB signing, and set a group policy that blocks unsigned SMB connections from non-domain machines. The Australian Cyber Security Centre publishes a straightforward guide to essential hardening, and following its baseline mitigations closes most of the gaps that worms rely on.

Finally, audit who has write access to each shared folder. Many Perth and Canberra offices have grown over the years and ended up with Everyone:Full Control on legacy shares, which is exactly the permission a worm is hoping for. Replace broad access with explicit groups, set a strong password policy that survives a brute-force attempt, and rotate any account credentials that may have been captured during the outbreak. For ongoing reading on prevention, response playbooks, and removal walkthroughs, the Pc Malware Expert homepage is a sensible bookmark for the IT person who has to handle this again next quarter.