What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Isolate the suspected computer before you try to clean it. A worm can continue scanning for vulnerable systems and copying itself while you investigate. Use managed endpoint containment if it is available; otherwise unplug Ethernet, remove the device from Wi‑Fi, or power it down if it cannot be disconnected. Then investigate neighboring devices, scan or reimage the original host, reset exposed credentials, and verify that both the endpoint and network are quiet before reconnecting anything.
One symptom is not proof of a worm. Confirm the suspicion with endpoint alerts, security-tool behavior, system evidence, and network telemetry. The procedure below is designed for Windows environments, with additional incident-response guidance for business networks.
What a computer worm is and why the order of response matters
A worm is self-propagating malware. Unlike a virus that typically needs a host file, a worm can replicate on its own and move from one system to another. NIST describes worms as self-replicating, self-propagating programs that may exploit software vulnerabilities or unsecured Windows shares. A network-service worm scans for other computers running the targeted service, then attempts to infect them. That activity can spread rapidly, consume network capacity, and create a large volume of security alerts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common propagation routes include email attachments, messaging and file-sharing platforms, network shares, removable drives, and unpatched software vulnerabilities. Microsoft summarizes the risk plainly: “A worm is a type of malware that can copy itself and often spreads through a network by exploiting security vulnerabilities.” Because replication can continue during a scan, containment comes before cleanup.
#1 Best Overall
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
Signs that justify a worm investigation
These clues are investigation triggers, not proof by themselves. Hardware failures, ordinary software bugs, and failing storage can produce similar symptoms. Look for several clues together and correlate endpoint observations with network evidence.
| Observation | What it may indicate | How to corroborate it |
|---|---|---|
| Sudden slowdown, repeated crashes, or frequent unresponsiveness | Malware activity, resource exhaustion, or an unrelated hardware or software fault | Check endpoint alerts, running processes, disk and network activity, and whether the behavior appears on other hosts |
| Antivirus, Task Manager, Windows Update, or other security tools will not start | Malware may be blocking defenses, although corruption or policy restrictions can look similar | Try the tools only after isolation and review security logs or central endpoint telemetry |
| Security websites or Windows Update become unreachable | Possible interference intended to prevent updates, signatures, or investigation | Compare the same destinations from a known-clean device and inspect DNS, firewall, and proxy records |
| Unexpected browser-homepage changes or persistent pop-ups | Potential unwanted software or malware persistence | Inspect extensions, startup entries, scheduled tasks, and endpoint detections |
| An alert names a worm, suspicious executable, or repeated blocked scans | A higher-confidence indicator that needs immediate containment | Record the detection name, file path, timestamp, affected user, and related network connections |
| Unusual outbound scanning or repeated lateral connections | Possible self-propagation or another compromised service | Use host and network monitoring, including EDR where available, to identify destinations, ports, frequency, and other hosts showing the same pattern |
First minutes: contain the suspected device
Do not start by deleting files or rebooting repeatedly. Every minute online can give a worm another opportunity to scan or copy itself.
1. Use managed endpoint containment when available
In a business environment, use your EDR or endpoint console’s containment action. Microsoft Defender for Endpoint containment blocks incoming and outgoing communication with the device while it is investigated. Record who initiated containment and the time, because those details help correlate endpoint, firewall, authentication, and server logs.
2. Disconnect a device you cannot contain centrally
- Unplug the Ethernet or network cable.
- If the computer is on Wi‑Fi, remove it from the wireless network or disable its Wi‑Fi connection.
- Disconnect removable drives and other network-connected media without opening files on them.
- If the computer cannot be disconnected safely, power it down. CISA specifically recommends powering down devices that cannot be disconnected to avoid further spread.
Do not reconnect the computer merely because one quick scan reports no detection. The scan may have missed an unknown variant, a dormant component, or a neighboring host that can reinfect it.
3. Preserve evidence when this is an organizational incident
Follow the incident-response plan before making destructive changes. Retain relevant firewall, endpoint, authentication, and system logs. In a business investigation, forensic imaging and memory capture may be appropriate before reimaging. If you are responsible for a home computer, at minimum write down the detection name, times, accounts in use, connected shares, removable media, and any other computers that showed the same behavior.
Rank #2
- Cat 6 performance at a Cat5e price but with higher bandwidth
- High Performance Cat6, 30 AWG, RJ45 Ethernet Patch Cable provides universal connectivity for LAN network components such as PCs,computer servers,printers,routers,switch boxes,network media players,NAS,VoIP phones
- Jadaol cat6 standard cable support Cat8 and Cat7 network and provides performance of up to 250 MHz 10Gbps and is suitable for 10BASE-T, 100BASE-TX (Fast Ethernet), 1000BASE-T/1000BASE-TX (Gigabit Ethernet) and 10GBASE-T (10-Gigabit Ethernet)
- UTP(Unshielded Twisted Pair) patch cable with RJ45 gold-plated Connectors and are made of 100% bare copper wire, ensure minimal noise and interference
- The unique flat cable shape allows for a cleaner and safer installation. You can easily and seamlessly make the cable run along walls, follow edges & corners or even make it completely invisible by sliding it under a carpet.
Containment choices compared
| Response choice | Isolation speed | Evidence preservation | Removal confidence | Operational impact |
|---|---|---|---|---|
| EDR or switch-level containment | Usually fastest when centrally managed | Best chance of retaining live telemetry and logs | Does not remove malware; it only stops communication while you investigate | Device remains powered but unavailable to normal network services |
| Unplug Ethernet or remove Wi‑Fi | Immediate if someone is physically present | Preserves the powered-on state, but may lose volatile evidence if the device is later shut down | Does not remove malware | Network access stops; local work may continue offline |
| Power down | Immediate when network disconnection is impossible | May preserve disk evidence but loses live memory and active connections | Does not remove malware | Complete device downtime |
Determine what else may be exposed
A worm incident is a network problem, not just a single-computer problem. Make an inventory of computers, servers, network shares, printers, removable drives, and virtual machines that the suspected host could reach. Include systems that shared the same credentials or ran the same vulnerable service.
- Identify hosts that exchanged files with the suspected device.
- Review authentication logs for the same user, administrator, or service account on other systems.
- Check firewall and network telemetry for repeated scans, lateral connections, and unusual connection times or frequencies.
- Inspect shared folders for newly created or modified executables and scripts.
- Ask whether a USB drive, external disk, or other removable medium moved between the affected computer and a clean one.
- Place any host with matching alerts or scanning behavior into containment before it can become a second source of spread.
For an organization, map the affected subnets and dependencies before changing access rules. A current network diagram makes it easier to locate systems that share a service or trust relationship with the first infected host.
Recommended Free Tools
Clean an isolated Windows computer
Update from a trusted source
Keep the computer isolated while preparing the cleanup. Obtain operating-system updates and security-tool updates from a source you trust, using a known-clean administrator workstation or approved enterprise management channel when possible. Do not reconnect an unpatched host directly to the production network just to download updates.
Run a comprehensive scan
Start with a full scan using the security product already managed by your organization or Windows Security. On a Windows computer, the usual path is Windows Security → Virus & threat protection → Scan options → Full scan. If ordinary scanning cannot start, use an offline or standalone scanner prepared from a trusted device.
| Microsoft option | Best use | Important limitation or behavior |
|---|---|---|
| Microsoft Defender Offline | Scanning when malware may be active in the normal Windows environment or may interfere with security tools | Runs outside the normal Windows session; save work first and follow the restart prompts |
| Microsoft Safety Scanner | Comprehensive, on-demand detection and removal when you need a standalone check | Download a current copy from Microsoft before use; the tool is not a substitute for ongoing antivirus protection |
| Malicious Software Removal Tool (MSRT) | Checking for a limited set of prevalent threats | Microsoft states that MSRT does not provide comprehensive detection and removal; use Defender Offline or Microsoft Safety Scanner for broader coverage |
Run the scan with the device still isolated. Save the detection name, affected file path, and action taken. If a scan finds a named worm, use the vendor’s family-specific indicators and eradication guidance; generic scanning cannot prove that every variant-specific persistence mechanism is gone.
Rank #3
- Designed for Outdoor & Direct Burial Installations – Heavy-duty double-shielded Cat8 Ethernet cable minimizes EMI/RFI interference and delivers stable long-distance performance. Waterproof, anti-corrosion PVC jacket allows safe direct burial and reliable use in outdoor or indoor environments.
- 26AWG for Stable High-Load Networks – Thicker 26AWG conductors provide faster, more stable data transmission than standard 32AWG cables. Ideal for high-performance home networks, gaming setups, smart homes, and data-intensive applications.
- F/FTP Shielding & Hyper-Speed Performance: Cat8 Ethernet cable constructed with 4 shielded foiled twisted pairs and 26AWG OFC conductors; supports bandwidth up to 2000 MHz and data transmission speeds up to 40 Gbps, effectively reducing signal interference and ensuring stable connections. Ideal for low-latency gaming, 4K/8K streaming, and high-speed internet connections.
- RJ45 Connectors & Wide Compatibility: Cat8 Ethernet cable with two shielded RJ45 connectors; compatible with networking switches, IP cameras, routers, Nintendo Switch, modems, PS3, PS4, Xbox, patch panels, servers, smart TVs, and more; works with Cat7, Cat6, Cat5e, and Cat5 devices
- Weatherproof & UV Resistant: Outdoor-rated Cat8 Ethernet cable with UV-resistant PVC jacket; withstands direct sunlight, extreme cold, humidity, and hot weather; anti-aging and durable; Includes 18-month support.
Quarantine or remove detected items
When Microsoft security software reports a threat, choose Quarantine or Remove unless you have a documented reason to trust the file. Quarantine blocks execution while preserving the item for review. Choosing Allow suppresses future alerts for that file and should be reserved for a file from a trusted publisher that you have independently verified.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhen reimaging is the safer option
Isolate and reimage the computer from trusted installation or recovery media when any of these conditions apply:
- The worm disables or prevents security tools from running.
- The same detection returns after removal or after a restart.
- You cannot identify all startup entries, services, scheduled tasks, or other persistence mechanisms.
- The machine has unknown administrative changes or unexplained outbound scanning.
- You cannot establish reasonable confidence that the cleanup removed the complete infection.
CISA recommends reimaging or removing compromised systems found on a network. Before reimaging a business device, preserve evidence required by your incident-response process. After installation, apply operating-system and application patches, enable security controls, and restore only data that has been checked; do not restore unknown executables or scripts from an untrusted backup.
Reset credentials and revoke access
Assume that credentials used on the affected computer may have been exposed. Reset passwords and revoke active tokens for accounts used there, giving priority to privileged, administrator, service, and shared accounts. Use strong, unique administrator passwords and avoid broad domain-administrator use for routine work. Change credentials from a known-clean device, not from the isolated host.
Verify the host and network before reconnecting
Reconnection is a decision based on evidence, not on a single green scan result. The following checks should all pass:
Rank #4
- High-Performance Connectivity: This Cat 6 ethernet cable is designed for superior performance, with a 24 AWG copper wire core. It provides universal connectivity as an ethernet cord for LAN network components such as PCs, servers, printers, routers, and more, ensuring reliable and fast network connections
- Advanced Cat6 Technology: Experience Cat6 performance with higher bandwidth at a Cat5e price. This network cable is future-proof, ready for 10-Gigabit Ethernet and backwards compatible with any existing Cat 5 cable network. It meets or exceeds Category 6 performance according to the TIA/EIA 568-C.2 standard
- Reliable Wired Network Solution: Known variously as a Cat6 network cable, ethernet cable Cat 6, or Cat 6 data/LAN cable, this RJ45 cable offers a more secure and reliable connection than wireless networks. It's ideal for internet connections that demand consistency and security
- Durable and Secure Design: The connectors of this ethernet cable feature gold-plated contacts and strain-relief boots for enhanced durability. Bare copper conductors not only improve cable performance but also comply with communication cable specifications
- High-Speed Data Transfer: With up to 550 MHz bandwidth, this ethernet cord is ideal for server applications, cloud computing, video surveillance, and streaming high-definition video. It also supports Power over Ethernet (PoE, PoE+, PoE++) for powering devices like IP cameras, VoIP phones, and wireless access points, ensuring fast and reliable network performance.
Endpoint checks
- A full scan and, when warranted, an offline scan report no active threats.
- Security software, Windows Update, and Task Manager open and operate normally.
- The operating system and installed applications are current with available security updates.
- Unexpected startup entries, services, scheduled tasks, browser extensions, and executables have been removed or explained.
- The computer no longer crashes, freezes, generates unexplained pop-ups, or changes browser settings.
- Passwords and tokens used on the device have been reset or revoked where exposure is possible.
Network checks
- Firewall, DNS, endpoint, and authentication telemetry no longer shows outbound scanning or repeated lateral connections.
- Peer computers, servers, shares, and removable media reachable from the device have been checked.
- Hosts with matching indicators have been contained and investigated.
- Any vulnerable service used by the worm has been patched, disabled, or restricted before access is restored.
If a named worm was identified, compare your findings with the vendor’s indicators and eradication instructions. A generic “clean” result cannot establish that a particular worm family is absent when its persistence or propagation method is unknown.
Reconnect with controls and monitoring
Reconnect a repaired host to a restricted or monitored network segment first when your environment supports it. Watch endpoint and network telemetry for renewed scans, repeated authentication failures, unusual connections, or a new alert. Keep the device under observation long enough to cover its normal workload, including scheduled tasks and file-sharing activity.
If activity returns, isolate the host again and treat the event as an unresolved compromise. Do not repeatedly reconnect and disconnect the same machine while hoping a later scan will succeed; that pattern can allow reinfection and make the timeline harder to reconstruct.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prevent another worm outbreak
Patch before attackers can exploit the gap
Apply operating-system and application security updates promptly. Worm campaigns often exploit the period between public vulnerability disclosure and the deployment of patches or updated security signatures. Prioritize internet-facing and widely deployed services, then verify that updates actually reached every relevant host.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Reduce removable-media and share-based propagation
- Disable AutoPlay where it is not needed.
- Remove excessive write permissions from network shares and grant access only to users and systems that require it.
- Use least privilege for local and domain accounts.
- Keep administrator passwords strong and unique rather than reusing one password across machines.
Segment the network
Separate users, servers, administrative systems, and sensitive services into network segments. Restrict traffic between segments to the protocols and destinations that are required. Segmentation does not remove a worm, but it limits the number of systems a compromised host can scan or reach.
Best Value
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
Protect backups from the same infection
Keep backups offline or otherwise isolated from network connections that could carry malware into the backup set. Test restoration regularly. A backup that is continuously writable from an infected network may preserve the worm alongside the data you need.
Maintain an incident-response plan
Document who can isolate endpoints, disable accounts, change firewall rules, collect logs, approve reimaging, and communicate with affected users. Keep a current network diagram with subnets, key services, shares, and dependencies. During a fast-moving outbreak, those details reduce the time between detection and containment.
What to do in common problem cases
The computer cannot be disconnected
Use EDR or switch-level containment if available. If no managed control can block communication, power down the device as CISA advises. Then investigate from another computer and preserve logs according to your incident-response process.
The scan is clean but the network still shows scanning
Keep the original host isolated and search for another source. A clean result may mean the wrong host was scanned, the malware is not covered by that scanner, or another computer is now propagating it. Compare timestamps and destinations across endpoint and firewall telemetry.
Security tools will not run
Do not disable more protections to force a normal scan. Keep the host isolated, use Microsoft Defender Offline or Microsoft Safety Scanner from a trusted source, and reimage if tools remain blocked or persistence cannot be explained.
Several computers share one administrator password
Contain the affected systems, reset the shared credential from a known-clean device, and replace it with unique administrator credentials. Review authentication logs for use of that account on every reachable host.
This is a home network with no EDR
Unplug the suspected computer or remove it from Wi‑Fi, then power it down if it cannot be disconnected. Disconnect external drives, check other computers and shared folders, update the operating system and security software, and run a full or offline scan. If the infection returns or you cannot verify removal, back up only checked personal data and reinstall the operating system from trusted media before reconnecting.
When professional incident response is warranted
Escalate to an incident-response or security professional when a worm reaches servers, domain controllers, business-critical shares, multiple subnets, or privileged accounts; when evidence must be preserved for legal or regulatory reasons; or when the source and scope remain uncertain after containment. The goal is not merely to make one computer appear normal, but to identify every exposed host, remove persistence, and prevent the same path from reopening.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
