Step-by-step cleanup of an email attachment worm

An email worm is malware designed to spread from one compromised device to another, often by sending copies of itself to contacts in the victim’s address book. It may arrive as a Word document, spreadsheet, archive, executable, shortcut, or seemingly harmless PDF. Once opened, the worm can copy itself to local folders, modify startup settings, and send new messages without the user’s permission.

Common warning signs include unexpected messages sent from your account, bounced emails to unknown recipients, rapidly changing file names, disabled security tools, unusual network activity, and a sudden slowdown. Treat these symptoms as evidence of an active infection rather than simply a problem with your email provider.

The safest cleanup process combines containment, account protection, malware scanning, and careful file restoration. Avoid opening the suspicious attachment again, even if it appears to come from someone you know.

Recognize the infection and stop interacting with it

Disconnect the affected computer from Wi-Fi or unplug its network cable. If the worm is spreading through a shared office network, disconnecting the device limits additional email transmissions and reduces the chance that shared folders will be infected. Do not reconnect merely to download a scanner until you have confirmed that the tool is safe and obtained it from a trusted source.

Record the suspicious email’s sender, subject, attachment name, delivery time, and any unusual behavior. Preserve this information without forwarding the attachment. Notify your email provider, workplace administrator, or trusted contacts through a separate communication channel so they know that messages from your account may be unsafe.

If the computer is used for banking, business administration, or access to sensitive records, stop using those services on it. Use a separate, clean device to change passwords and review account activity.

Secure accounts from a clean device

Start with the email account because a worm can continue spreading even after the original computer is disconnected. From a known-clean phone or computer, change the email password and enable multifactor authentication. Check forwarding rules, filters, automatic replies, recovery addresses, and connected applications for changes you did not make.

Sign out of active sessions wherever the provider allows it. Review sent mail, deleted messages, login history, and recent security events. Warn contacts who may have received the malicious attachment, but do not include the file in your warning. Tell them to delete the message and scan their own systems.

Use unique passwords for email, cloud storage, social media, and financial accounts. A password manager can help create different credentials, while multifactor authentication adds protection if a password was captured by spyware or a credential-stealing trojan.

Map the damage before removing files

A careful inventory helps distinguish the original worm from legitimate system files. Look for unfamiliar programs, recently created executables, odd startup entries, new browser extensions, and documents with unexpected extensions. Check whether removable drives, shared folders, or cloud-sync directories contain duplicate suspicious files.

The following indicators can help prioritize the response:

Observation	Likely significance	Immediate response
Messages sent without your action	Email account or local mail client may be compromised	Change credentials from a clean device
Repeated copies on USB drives	The worm may use removable media for propagation	Disconnect drives and scan them separately
Unknown startup entry	Malware may relaunch after reboot	Document it before disabling or removing it
Disabled antivirus or firewall	Security settings may have been tampered with	Restore protection and run an offline scan
Encrypted or renamed files	A second threat, such as ransomware, may be present	Isolate the system and preserve affected files

Do not delete every unfamiliar file at random. Some worms use legitimate system processes or temporary folders, and careless removal can make Windows or macOS unstable. If the symptoms include encryption, ransom notes, or inaccessible documents, treat the incident as a possible ransomware attack; these LockBit recovery guidance resources explain why evidence preservation and backups matter.

Run layered malware scans

Update a reputable antivirus or antimalware program using a clean download source, then perform a full system scan. If the infection blocks security software, use Windows Safe Mode with Networking only when necessary and disconnect the network again after downloading the approved scanner. Windows users can also use Microsoft Defender Offline to scan before the operating system fully loads.

On macOS, review Login Items, unfamiliar Applications, browser extensions, profiles, and permissions under Privacy & Security. On Windows, inspect startup apps, scheduled tasks, installed programs, and suspicious processes. Remove confirmed malicious components through the security tool whenever possible instead of manually deleting system files.

Run a second-opinion scan from a well-established security vendor after the first scan completes. A worm may install a downloader, password stealer, or browser hijacker as a secondary payload, so inspect browser settings and extensions too. Guidance about browser hijacker guides can help identify unwanted search changes, redirects, and injected advertisements.

Clean removable media and shared locations

Before reconnecting USB drives, external disks, or mapped network folders, scan each item separately. Disable automatic execution features where available, and show file extensions so a malicious program disguised as a document is easier to spot. A file named “Invoice.pdf.exe” is an executable, even if the first extension is hidden by default.

Ask an administrator to inspect shared folders and mail server logs if the computer belongs to an organization. Remove unauthorized copies only after documenting their locations and confirming that no legitimate business files will be affected. If the worm used network shares, every connected computer should be scanned before normal file sharing resumes.

Restore documents from a backup made before the suspicious activity began. Scan restored files before opening them, and avoid relying on a backup drive that was connected while the worm was active unless it has been examined carefully.

Recommended recovery practices

After cleanup, monitor the account and computer for several days. Recurring outbound messages, renewed security alerts, unknown processes, or repeated file copies indicate that the infection may still be present. In that situation, preserve logs and consider professional incident-response assistance rather than repeatedly deleting visible files.

Use these safeguards during recovery:

• Keep operating systems, browsers, email clients, and security software fully patched.
• Configure email filtering to block risky executable attachments and unexpected macro-enabled documents.
• Disable Office macros by default and allow them only for verified business files from trusted sources.
• Scan USB drives and shared folders before opening their contents.
• Maintain offline or versioned backups that cannot be altered by an infected computer.

Reconnect carefully and monitor activity

Reconnect the cleaned device only after scans are clear, suspicious startup items are gone, and account credentials have been changed. Send a test message to a trusted address and verify that it appears only once, with no unexpected attachment. Watch network usage, sent mail, login alerts, and security notifications during the following days.

If the worm returns, multiple devices are affected, or sensitive credentials may have been exposed, disconnect the system again and escalate the incident. A clean reinstall may be safer than manual removal when the malware has modified system components or when scan results remain inconsistent.

Begin with isolation and account protection today, then complete the scans, backup checks, and monitoring steps before resuming normal email activity. Acting quickly can stop further attachment-based spread and reduce the chance that a simple infection becomes a larger data-loss event.