Trojans and worms behave very differently from the pop-up-generating adware most people picture — trojans disguise themselves as legitimate software to open a backdoor, while worms actively spread across a network without any user interaction at all. Both can lead to stolen credentials, ransomware deployment, or your PC being enlisted into a botnet. This guide covers how to spot the specific warning signs, safely isolate the machine, and fully remove the infection.

Trojan vs Worm: Why the Distinction Matters

  • A trojan disguises itself as something useful (a cracked game, a fake invoice attachment, a bundled "codec pack") and, once run, quietly installs additional malicious payloads — keyloggers, remote access tools, or ransomware droppers.
  • A worm self-replicates and spreads across a network on its own, often exploiting an unpatched vulnerability in Windows networking services, without needing you to open anything.

This matters because a worm on one PC in your household or office network can spread to others before you've even noticed the first infection — isolation (Step 1) is more urgent for worms than for a single-machine trojan.

Warning Signs of a Trojan or Worm Infection

  • Unfamiliar processes in Task Manager consuming CPU, disk, or network bandwidth persistently
  • Your antivirus or Windows Defender being disabled without your action, or unable to turn back on
  • Unusual outbound network traffic when you're not actively using the internet
  • New user accounts or scheduled tasks you didn't create
  • Other devices on your home network suddenly showing infection warnings shortly after this PC started behaving oddly (a strong sign of a worm)
  • Programs crashing or running slowly that previously worked fine
  • Your firewall reporting blocked connection attempts to unfamiliar IP addresses

Safety warning: If you suspect a worm, disconnect the infected PC from your network (unplug Ethernet, turn off Wi-Fi) before doing anything else. Worms actively scan the local network for other vulnerable machines — leaving it connected risks spreading the infection to every other device sharing that network, including phones and smart TVs on the same Wi-Fi.

Step 1: Isolate the Machine

  1. Disconnect Ethernet and disable Wi-Fi immediately — right-click the network icon in the system tray and select Disable, or physically remove the cable.
  2. Do not log into any accounts (email, banking, work) from this machine until it's confirmed clean — credentials entered on an infected PC may already be compromised or could be captured live by a keylogger.
  3. If this PC shares a network with other devices, check them for signs of infection too once the infected machine is isolated.

Step 2: Boot Into Safe Mode With Networking

Running the removal process in Safe Mode stops most malware from loading, since it typically relies on normal startup processes.

  1. Go to Settings > System > Recovery > Advanced startup > Restart now.
  2. After restart, choose Troubleshoot > Advanced options > Startup Settings > Restart.
  3. Press 5 or F5 to select Safe Mode with Networking — you'll need this specific mode (not plain Safe Mode) so you can download removal tools, but keep Wi-Fi/Ethernet physically disconnected until you're ready to download tools, then reconnect only briefly and carefully.

For a full walkthrough of entering Safe Mode on different Windows versions, see our dedicated Safe Mode guide.

Step 3: Run a Full Scan With Windows Defender

  1. Open Windows Security (search from the Start menu).
  2. Go to Virus & threat protection > Scan options.
  3. Select Microsoft Defender Offline scan — this restarts the PC into a minimal environment outside normal Windows, which is much harder for active malware to hide from or interfere with than a scan run from within a live infected system.
  4. Let the scan run to completion; it can take 15-30 minutes.
  5. Review and action any detections under Protection history.

Step 4: Run a Second Opinion Scan With Malwarebytes

Different scanners catch different things, and trojans specifically are often designed to evade a single vendor's detection signatures.

  1. Download Malwarebytes free edition from the official malwarebytes.com site — only from the official site, since fake "malware removal tools" are themselves a common trojan delivery method.
  2. Install and run a Threat Scan (the default full scan).
  3. Quarantine everything it finds, then restart.
  4. Run a second scan after restart to confirm nothing was missed or reinstalled by a surviving component.

Pro tip: Some trojans install a "watchdog" companion process that reinstalls the main payload if it's removed. If Defender or Malwarebytes keeps re-detecting the same or similar threat after multiple "successful" removals, this is the likely cause — a second, independent scan (Step 4) combined with a Safe Mode scan (Step 3) is specifically designed to catch this pattern.

Step 5: Check for Persistence Mechanisms

Trojans commonly set themselves to run automatically at startup, so check these locations even after a clean scan result:

  1. Open Task Manager > Startup apps and disable anything unfamiliar.
  2. Open Task Scheduler (search from Start menu) and check the Task Scheduler Library for unfamiliar scheduled tasks, particularly ones running frequently or pointing to files in Temp or AppData folders.
  3. Run msconfig and check the Services tab (tick "Hide all Microsoft services" first) for unfamiliar entries.
  4. Check installed browser extensions in Chrome, Edge, and Firefox settings — remove anything you didn't intentionally install.

Step 6: Reset Compromised Credentials

Once the PC is confirmed clean:

  1. From a different, known-clean device, change passwords for any accounts you logged into on the infected PC — email, banking, cloud storage, and anywhere you reuse passwords.
  2. Enable two-factor authentication on important accounts if not already active.
  3. Check your email account's "recent activity" or "connected devices" page for any unfamiliar logins during the infection period.
  4. Consider these credentials compromised even if the malware "looked like" it only affected the system — trojans very commonly include a keylogging or credential-stealing component you may not directly observe.

Step 7: Update and Patch Everything

Worms in particular spread via unpatched vulnerabilities.

  1. Run Windows Update fully, including optional updates, and restart as needed.
  2. Update your router's firmware — some worms specifically target home routers.
  3. Update all installed applications, particularly browsers, Java, and any remote access software (TeamViewer, AnyDesk) which are common targets.
  4. Re-enable your firewall if it was disabled, and confirm Windows Defender's real-time protection is active.

Step 8: Consider a Clean Reinstall for Severe Cases

If the infection involved ransomware behaviour, a rootkit component, or you simply can't get consistent clean scan results across multiple tools:

  1. Back up personal files (documents, photos) to an external drive — but scan the backup itself with an updated antivirus before restoring it to a clean system, since backing up an infected file just reintroduces the problem later.
  2. Perform a full Windows reinstall via Settings > System > Recovery > Reset this PC, choosing "Remove everything," or a clean install from official Microsoft installation media.
  3. This is the only way to be certain a deeply embedded rootkit-style trojan is fully gone, since some can survive even a full antivirus removal by hiding at the firmware or boot-sector level.

Trojans and worms are more serious than typical adware precisely because of what they enable next — credential theft and network spread — so treat any confirmed infection as a reason to also audit your account security, not just clean the machine.

Was this guide helpful? Explore more Malware Removal guides, or browse all Security & Performance articles.