Step-by-step guide to removing a worm from network shares

A network worm can move rapidly between computers by exploiting shared folders, weak passwords, outdated software, or unsafe permissions. Unlike a conventional virus that may remain on one device, a worm can copy itself across mapped drives, NAS appliances, servers, and removable storage, creating repeated reinfections after cleanup.

This guide explains how to contain and eradicate the threat on Windows networks, including small offices, home businesses, and mixed environments commonly found across Australia. The priority is to stop propagation first, preserve useful evidence, then clean affected systems and close the weakness that allowed the malware to spread.

Contain the outbreak immediately

Disconnect suspected computers from Wi-Fi and Ethernet, but do not switch them off unless they are actively damaging files or exhausting resources. Isolation prevents further access to shared folders while keeping volatile evidence, such as running processes and network connections, available for investigation. Unplugging a network cable is often faster than navigating operating-system settings.

On a business network, contact the person responsible for IT or managed services before changing server settings. Ask staff in Sydney, Melbourne, Brisbane, Perth, and other offices to stop opening shared documents or reconnecting mapped drives. If the organisation uses Microsoft 365, cloud storage, or an NBN-connected router, separate the infected local segment from the internet without deleting logs or backups.

Identify affected devices and shares

Create a simple incident list containing the computer name, user, location, time of discovery, and visible symptoms. Look for newly created executable files, unexplained shortcuts, disabled security tools, unusual CPU or disk activity, and repeated alerts from Microsoft Defender or another endpoint security product. Worms may also leave copies with misleading names in shared folders.

Temporarily disable write access to the most sensitive shares, especially finance, payroll, customer records, and backup locations. Avoid opening suspicious files to “test” them. Check file-server audit logs, antivirus consoles, and router or firewall records to identify which device first accessed the infected share. A NAS device should be treated as a potentially affected endpoint until its firmware, accounts, and stored files have been checked.

Secure accounts and network access

From a known-clean device, reset passwords for users and administrators who accessed the compromised shares. Use unique passwords and revoke active sessions where possible. Prioritise domain administrators, local administrators, VPN accounts, NAS accounts, and service accounts. Do not reset passwords from an infected computer because keystrokes or new credentials could be captured.

Review permissions so ordinary users have only the access required for their roles. Disable anonymous or guest access, remove obsolete accounts, and avoid giving broad write permissions to everyone. Small Australian businesses often rely on a single shared drive for operations, but separating departments and restricting executable file types can significantly reduce the worm’s reach.

Scan and clean every endpoint

Begin with updated security software on each isolated machine. Microsoft Defender Offline, a reputable enterprise endpoint platform, or a trusted bootable scanner can inspect files before normal Windows processes load. Run a full scan rather than relying only on a quick scan, and review quarantine results for the worm’s name, persistence entries, scheduled tasks, services, and startup items.

Clean all potentially exposed computers, not just the one showing the first alert. A worm can remain dormant on a laptop that is away from the office and reinfect the network when it returns. Safe Mode may help when malicious processes block security tools, although business users should record changes and involve an administrator before removing system files or registry entries. If a device cannot be trusted, wipe and rebuild it from verified installation media.

Restore files without reintroducing malware

Do not reconnect backups until they have been scanned and their creation dates have been checked. Malware may copy itself into backup sets or encrypt files on connected backup drives. Keep at least one backup offline or logically separated from everyday accounts, and confirm that restoration points predate the first suspicious activity.

If the worm has damaged documents, preserve affected copies before attempting repair. For ransomware symptoms, follow this network drive guidance, which covers containment and recovery considerations. Never assume that a file is safe because its extension looks familiar; inspect it with security software before restoring it to a shared location.

Verify recovery and harden the environment

After cleaning, reconnect one system at a time and monitor it for unexpected connections, new files, or renewed antivirus alerts. Test shared folders with a standard user account, then confirm that permissions prevent unauthorised writing and execution. Keep logs for the incident, including affected hosts, removed files, password resets, scans, and restoration steps. This record may support insurance, legal, or regulatory obligations.

Australian organisations can use the Australian Signals Directorate’s Essential Eight as a practical security baseline. Patch operating systems and network appliances, enable multifactor authentication for remote access, restrict administrative privileges, and maintain tested backups. Home users should update routers, disable unused SMB services, and avoid exposing file-sharing ports directly to the internet. If specialist guidance is needed, educational resources and contact information are available through Pc Malware Expert contact.

Investigation stage	Main objective	Safe action
Containment	Stop the worm spreading	Isolate devices and restrict share access
Discovery	Find the infection path	Review endpoint, server, and firewall logs
Account protection	Prevent continued access	Reset credentials from a clean device
Eradication	Remove malicious components	Run offline and full scans on every exposed host
Recovery	Return files safely	Restore verified backups in stages
Prevention	Reduce repeat infections	Patch systems, apply least privilege, and monitor shares