Malicious file
worm.exe: what the file is and how to remove it
worm.exe is not a Windows file, and no publisher is known to ship it. The old report tied it to the worm01@india.com variant of Dharma ransomware and to several old worms. If it appeared on the desktop with files renamed to .dharma, it is ransomware. Check the folder and scan before deleting anything.
Prefer to do it yourself? The manual steps follow.
A worm.exe you did not install is malware. The old report linked it to one Dharma ransomware variant, where it appeared on the desktop after infection, and to several older worms that used the same name.
The name alone proves nothing. A harmless program someone built can use it too, so check the folder and signature. If your files have the .dharma extension, treat the PC as infected: removing worm.exe does not unlock the files.
- Type
- Generic executable name; reported as the main file of one Dharma ransomware variant and as a component of old worms
- Publisher
- None known. No genuine Windows or vendor file of this name could be confirmed
- Also known as
- worm file, worma; the ransomware family is also called CrySiS
- Ransom contact
- worm01@india.com, per the old report
- Encrypted file names
- Marked with the extension .[worm01@india.com].dharma, per the old report
- Ransom note
- README.txt on the desktop, per the old report; other Dharma notes have been documented as Info.hta and FILES ENCRYPTED.txt
- Worms named by the old report
- W32.HLLW.Syney, I-Worm.Gift.b, Digital Doom Worm, Docworm and I-Worm.Hybris.b
- Typical folder
- The desktop for the ransomware, per the old report; for the worms no folder is known
What worm.exe is
worm.exe is a file name, not a product. The old report described it as an executable that starts a parasite or one of its components, and as a significant part of a dangerous threat that can also work on its own.
Most readers meet the name after a Dharma ransomware infection. In that report, users found worm.exe on the desktop right after the infection, and it appeared on systems hit by the worm01@india.com version. Dharma is a large family with many variants, so the file belongs to one of them, not to the whole family.
Once run, the ransomware encrypts files on the PC and renames them with the extension .[worm01@india.com].dharma. The victim cannot get the files back without the attackers' key, and the attackers offer to sell it. The ransom note was reported as short, only a few lines telling the victim to email worm01@india.com for instructions.
Dharma, also called CrySiS, is documented by FortiGuard Labs as ransomware that is often delivered by hand through leaked or vulnerable remote desktop (RDP) credentials. It sets itself to start when the user signs in to Windows.
The old report also named worm.exe as a file installed or used by the worms W32.HLLW.Syney, I-Worm.Gift.b, Digital Doom Worm, Docworm and I-Worm.Hybris.b. It gave no detail on how each behaves, and we could not confirm those links from a source. Treat them as historic reports.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How it gets on a PC
The old report said ransomware, trojans and other malware reach a PC when the user opens a malicious email attachment or clicks a link in an email. Installing the attachment is how worm.exe was said to land on the PC as the ransomware's main file.
FortiGuard Labs documents a second route for Dharma: attackers sign in by hand through exposed remote desktop services, using stolen or guessed credentials, and run the ransomware themselves. A PC with RDP open to the internet and a weak password is at risk.
For the older worms in the list, the old report gave no route.
How to find it
Do these in order. Note what you find before you change anything.
- Look at your files Open a folder of documents. Names ending in .[worm01@india.com].dharma, plus a README.txt note, mean the Dharma ransomware ran. Disconnect the PC from the network and the internet first, so it cannot spread or send data.
- Look for a running process Press Ctrl+Shift+Esc, open the Details tab and look for worm.exe. Right-click it and choose Open file location. Do not run the file again.
- Search the drive for the file Open Command Prompt and search the drive. Note every folder where the name appears, the desktop in particular.
dir /s /b C:\*worm.exe - Check the digital signature Right-click the file, open Properties > Digital Signatures. No signature, or an unknown signer, is a reason for caution. In PowerShell:
Get-AuthenticodeSignature "C:\path\to\worm.exe" | Format-List Status, SignerCertificate - Check what starts at sign-in Open Task Manager > Startup apps, and Task Scheduler for tasks that run the file. Ransomware of this family sets itself to start at sign-in.
- Scan the PC Update Windows, then run a full scan from Windows Security > Virus & threat protection > Scan options, and a Microsoft Defender Offline scan, which runs before Windows starts.
A signed worm.exe in the folder of a program you installed on purpose is most likely harmless. An unsigned worm.exe on the desktop beside renamed files is the ransomware.
How to remove worm.exe
Removing the file stops further damage but does not return encrypted files. The old report said no tool could decrypt .dharma files made by this variant, so a backup is the main way back. Free decryptors exist for older Dharma/CrySiS variants, so check before you assume the files are lost.
- Disconnect and keep the evidence Unplug the network cable or turn off Wi-Fi. Do not format the drive. Copy the encrypted files and the README.txt note to an external drive that you will not reconnect to this PC.
- Boot into Safe Mode with Networking Hold Shift while choosing Restart, then Troubleshoot > Advanced options > Startup Settings > Restart > press 5. Safe Mode keeps most startup entries from loading.
- Run the Microsoft Defender scans Run a full scan, then a Microsoft Defender Offline scan. Let it quarantine worm.exe and every other file it names. If you have difficulty removing the file, the offline scan runs outside Windows and handles it.
- Remove what starts at sign-in In Task Manager > Startup apps and Task Scheduler, disable and delete entries you do not recognise that point to worm.exe or to files in unusual folders.
schtasks /query /fo LIST /v - Change every password and close RDP Change passwords from a clean device, starting with Windows accounts and email. If RDP is not needed, turn off Remote Desktop in Settings > System > Remote Desktop. If it is needed, put it behind a VPN.
- Try to recover the files Restore from a backup made before the infection, once the PC is clean. If there is none, compare the ransom note and the extension with the free decryptors listed by the No More Ransom project. FortiGuard Labs says files encrypted by new variants of Dharma cannot be decrypted for free. Do not pay: the attackers' key may not work.
Warning signs around worm.exe
| What you see | What it means |
|---|---|
| Files renamed to .[worm01@india.com].dharma | The Dharma ransomware variant linked to worm.exe ran on the PC. |
| README.txt on the desktop with a few lines and an email address | The ransom note described by the old report: it tells the victim to email the attackers for instructions. |
| A different note, Info.hta or FILES ENCRYPTED.txt | The notes FortiGuard Labs documents for other Dharma variants. The family is the same; the variant differs. |
| worm.exe on the desktop that you did not put there | The old report found it there right after infection. |
| worm.exe in Temp, AppData or a folder with a random name | Not where a legitimate program keeps its files. Scan it and find what started it. |
| An unknown remote desktop session or a new user account | Dharma is often run by hand by attackers who sign in through RDP. |
Questions people ask
Is worm.exe a virus?
Yes, if you did not create or install it. The old report linked worm.exe to one variant of Dharma ransomware, where it appeared on the desktop after infection, and to several old worms. No genuine Windows or publisher file of this name is known. Check the folder and signature and run a full scan, because a harmless program can use the same name.
What is the worm file on my desktop?
If renamed files with the .dharma extension and a README.txt note appeared beside it, it is the ransomware's main file, per the old report. Do not run it again. Disconnect the PC, copy the encrypted files to a separate drive, then scan with Microsoft Defender, including the offline scan, and remove it.
Is there a worm virus removal tool or anti-worm software?
Microsoft Defender has full and offline scans that find and remove worms and ransomware files such as worm.exe, so no separate tool is required. Run the offline scan if a file stays. Removal does not decrypt your files. For that you need a backup or a decryptor from the No More Ransom project, which exists for older Dharma variants only.
Can I decrypt .dharma files?
Not for certain. The old report said no tool could decrypt files from this variant. The No More Ransom project lists free decryptors for CrySIS, the older name of the family, and FortiGuard Labs says newer variants cannot be decrypted for free. Try the decryptors on copies of your files after the PC is clean, and restore from a backup if you have one.
Is worm.exe the same as the MyDoom worm or the Dharma virus?
worm.exe is a file name used by more than one threat. The old report ties it to a Dharma ransomware variant and to the worms Digital Doom Worm, Docworm and others. It does not name MyDoom, and no source we checked links the two. Dharma is the ransomware family; worm.exe is a file that one of its variants used.
How did worm.exe get onto my PC?
By a malicious email attachment or link, per the old report, or by an attacker signing in through remote desktop, per FortiGuard Labs' research on Dharma. Check whether RDP is open to the internet and whether your passwords have been exposed. Both routes need a human action or a weak password, not a flaw in Windows itself.
How do I avoid ransomware like this?
Do not open email attachments from unknown senders. Check the sender's address, look for grammar errors and distrust messages that press you to open a file urgently. Install Windows updates so exploit kits find nothing to use. Keep Microsoft Defender on. Close RDP unless you need it, use strong passwords, and keep an offline backup.
Sources
Version data read on Oct 8, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…