question: How can one computer infected with a virus spread it over LAN?
comment: If it spreads on its own, it would be called a worm, not a virus. Home networking doesn't usually have particularly complicated configuration over the internal network. Your switch is just blindly shuffling data back and forth between devices on your network without caring what it is. You'd need more expensive & complex equipment to set things up safely. It would probably make more sense to unplug or upgrade the machine.
passages: BULLET::::- Computers infected with recent versions of Sality, such as Virus:Win32-Sality.AT, and Virus:Win32-Sality.AU, connect to other infected computers by joining a peer-to-peer (P2P) network to receive URLs pointing to additional malware components; the P2P protocol runs over UDP, all the messages exchanged on the P2P network are encrypted, and the local UDP port number used to connect to the network is generated as a function of the computer name
   BULLET::::- Sality may add a section to the configuration file %SystemRoot%\system.ini as an infection marker, contact remote hosts to confirm Internet connectivity, report a new infection to its author, receive configuration or other data, download and execute arbitrary files (including updates or additional malware), receive instruction from a remote attacker, and/or upload data taken from the affected computer; some Sality Variants may open a remote connection, allowing a remote attacker to download and execute arbitrary files on the infected computer
   Some variants of Sality can infect legitimate files, which are then moved to available removable drives and network shares by enumerating all network share folders and resources of the local computer and all files in drive C: (beginning with the root folder). It infects the files it finds by adding a new code section to the host and inserting its malicious code into the newly added section. If a legitimate file exists, the malware will copy the file to the Temporary Files folder and then infect the file. The resulting infected file is then moved to the root of all available removable drives and network shares as any of the following:
   "ProjectSauron" malware discovered in 2016 demonstrates how an infected USB device can be used to remotely leak data off of an air-gapped computer. The malware remained undetected for 5 years and relied on hidden partitions on a USB drive not visible to Windows as a transport channel between the air-gapped computer and a computer connected to the internet, presumably as a way to share files between the two systems.
   On 27 March 2009, Felix Leder and Tillmann Werner from the Honeynet Project discovered that Conficker-infected hosts have a detectable signature when scanned remotely. The peer-to-peer command protocol used by variants D and E of the virus has since been partially reverse-engineered, allowing researchers to imitate the virus network's command packets and positively identify infected computers en-masse.
  
  Signature updates for a number of network scanning applications are now available.
  
  It can also be detected in passive mode by sniffing broadcast domains for repeating ARP requests.
  
  Section::::Removal and detection.:US CERT.
   A virus may also send a web address link as an instant message to all the contacts (e.g., friends and colleagues' e-mail addresses) stored on an infected machine. If the recipient, thinking the link is from a friend (a trusted source) follows the link to the website, the virus hosted at the site may be able to infect this new computer and continue propagating. Viruses that spread using cross-site scripting were first reported in 2002, and were academically demonstrated in 2005. There have been multiple instances of the cross-site scripting viruses in the "wild", exploiting websites such as MySpace (with the Samy worm) and Yahoo!.
   Section::::Anti-malware strategies.:"Air gap" isolation or "parallel network".
  
  As a last resort, computers can be protected from malware, and infected computers can be prevented from disseminating trusted information, by imposing an "air gap" (i.e. completely disconnecting them from all other networks). However, malware can still cross the air gap in some situations. For example, removable media can carry malware across the gap. In December 2013 researchers in Germany showed one way that an apparent air gap can be defeated.
   Additionally, there are more sophisticated forms of data exfiltration. Various techniques can be used to conceal detection by network defenses. For example, Cross Site Scripting (XSS) can be used to exploit vulnerabilities in web applications to provide a malicious actor with sensitive data. A timing channel can also be used to send data a few packets at a time at specified intervals in a way that is even more difficult for network defenses to detect and prevent. 
  
  Section::::Preventative measures.
   BULLET::::- Ikee: The first worm known for iOS platforms. It only works on terminals that were previously made a process of jailbreak, and spreads by trying to access other devices using the SSH protocol, first through the subnet that is connected to the device. Then, it repeats the process generating a random range and finally uses some preset ranges corresponding to the IP address of certain telephone companies. Once the computer is infected, the wallpaper is replaced by a photograph of the singer Rick Astley, a reference to the Rickroll phenomenon.
   Section::::History.:Impact in Europe.
  
  Intramar, the French Navy computer network, was infected with Conficker on 15 January 2009. The network was subsequently quarantined, forcing aircraft at several airbases to be grounded because their flight plans could not be downloaded.
  
  The United Kingdom Ministry of Defence reported that some of its major systems and desktops were infected. The virus had spread across administrative offices, "NavyStar/N*" desktops aboard various Royal Navy warships and Royal Navy submarines, and hospitals across the city of Sheffield reported infection of over 800 computers.
   BULLET::::- Local Computer zone (or "My Computer" zone). This zone is particularly interesting because it can access files on the local computer. Historically this zone has been extremely insecure, but in recent versions Internet Explorer (for Windows XP) steps have been taken to reduce risks associated with zone.
  
  Local intranet, Trusted sites and Local Computer are usually configured to be privileged zones. Most cross-zone scripting attacks are designed to jump from Internet zone to a privileged zone.
  
  Section::::Examples.
  
  Section::::Examples.:Into the local computer zone.
  
  This type of exploit attempts to execute code in the security context of Local Computer Zone.
   If a computer is sending SYN packets or is connected to the client's computer, the connections can be discovered by using the netstat command or a common port listener like “Active Ports”.
  
  If the Internet connection is closed down and an application still tries to connect to remote hosts it may be infected with malware.
  
  Keyloggers and other malicious programs are harder to detect once installed, because they connect only once per session. Note that SYN packets by themselves are not necessarily a cause for alarm, as they are a standard part of all TCP connections.
   5lo stays resident. Whenever a .EXE file is run, 5lo will infect it (and another .EXE file). The virus also changes the file's timestamp to the date and time of infection. After these infections, a counter within the virus starts. However, this counter is never checked, so the virus doesn't activate. 5lo appends its code into infected files. It also changes the field 0Ch in the .EXE file's header to FFAAh. The virus identifies itself from memory by using the interrupt INT 21, AX=3521h which it has hooked. All the checks work correctly and the virus won't infect files multiple times and it installs itself to memory only once.
   BULLET::::- A "wireless infiltration" system can be used in proximity of the target when the target is using wireless technology. This is usually a laptop based system that impersonates a WiFi or 3G base station to capture the target systems and relay requests upstream to the Internet. Once the target systems are on the network, the system then functions as an "Injection Proxy" or as an "Upstream Monitor" in order to infiltrate or monitor the target system.
  
  BULLET::::- A "USB Key" preloaded with the malware infector may be given to or dropped at the target site.
   Jerusalem is a logic bomb DOS virus first detected at Hebrew University of Jerusalem, in October 1987. On infection, the Jerusalem virus becomes memory resident (using 2kb of memory), and then infects every executable file run, except for COMMAND.COM. .COM files grow by 1,813 bytes when infected by Jerusalem and are not re-infected. Executable files grow by 1,808 to 1,823 bytes each time they are infected, and are then re-infected each time the files are loaded until they are too large to load into memory. Some .EXE files are infected but do not grow because several overlays follow the genuine .EXE file in the same file. Sometimes .EXE files are incorrectly infected, causing the program to fail to run as soon as it is executed.
   BULLET::::- "Replicate": Agents may replicate themselves onto other media or systems, for example an agent may infect files on a writable network share or install themselves onto USB drives in order to infect computers protected by an air gap or otherwise not on the same network.
   Many worms, viruses, and attempts to take over a machine rely on changing the contents of memory so that the malware code is executed; or on executing "data" contents by misdirection. If execution of such malware could be blocked, it could do little or even no damage even after being installed on a computer; many, such as the Sasser worm, could be prevented from being installed at all.
   Once the worm is executed, either automatically by the buggy HTML engine or manually by a user, it searches for addresses to send itself to. When it sends itself out, it may attach a file from the infected machine, leading to possible privacy breaches.
  
  Later variants of the worm would use a false "From" address, picking an e-mail address at random from the infected machine's Outlook or Outlook Express address book, making it impossible for casual observers to determine which machine is infected, and making it difficult for experts to determine anything more than the infected machine's Internet Service Provider.
   In 1988, ARPANET saw its first widespread infection by self-replicating code: Morris, a worm that could install multiple copies of itself on the same computer, causing infected systems to grind to a halt. As the Morris worm began to spread in the United States, Spilling's American colleagues called to warn him. Faced with a threat to his nation's entire network of computers, he acted quickly and disconnected Norway from the rest of the Internet, which at the time could be done by unplugging a single cable.
  
  Spilling was also a local politician for the Conservative Party in Gjerdrum.
  
  Section::::External links.
   By renaming the database and putting a dummy database in its place, the worm would, in theory, go after the dummy, which could be designed with a hidden bomb. Ron Tencati, the SPAN Security Manager, obtained a copy of the French manager’s worm-killing program and gave it to McMahon, who tested it. It was then distributed to system administrators of both networks to be installed onto their computers. It still took weeks for the worm to be completely erased from the network.
  
  Section::::See also.
  
  BULLET::::- Father Christmas (computer worm)
  
  Section::::External links.
  
  BULLET::::- CERT advisory
   Linux.Wifatch's primary mode of infection is to log into devices using weak or default telnet credentials. Once infected, Linux.Wifatch removes other malware and disables telnet access, replacing it with the message "Telnet has been closed to avoid further infection of this device. Please disable telnet, change telnet passwords, and/or update the firmware."
  
  Section::::See also.
  
  BULLET::::- Denial-of-service attack
  
  BULLET::::- BASHLITE – another notable IoT malware
  
  BULLET::::- Linux.Darlloz – another notable IoT malware
  
  BULLET::::- Remaiten – another notable IoT malware
  
  BULLET::::- Mirai – another notable IoT malware
  
  BULLET::::- Hajime (malware) - malware which appears to be similar in purpose to Wifatch
   According to researcher Ralph Langner, once installed on a Windows system Stuxnet infects project files belonging to Siemens' WinCC/PCS 7 SCADA control software (Step 7), and subverts a key communication library of WinCC called codice_1. Doing so intercepts communications between the WinCC software running under Windows and the target Siemens PLC devices that the software is able to configure and program when the two are connected via a data cable. In this way, the malware is able to install itself on PLC devices unnoticed, and subsequently to mask its presence from WinCC if the control software attempts to read an infected block of memory from the PLC system.
   A malware embedded scanner was installed on a wireless network. An attack against the internal network initiated automatically using a server message block protocol. 
   Computers infected with malware such as Trojans sometimes open back doors into computer systems which allows malicious users to hack into and control the computer. Such users may then add, delete, modify or execute files on the computer to their own ends.
  
  Section::::Notable software.
  
  Section::::Notable software.:Windows.
   BULLET::::- Variants D and E create an ad-hoc peer-to-peer network to push and pull payloads over the wider Internet. This aspect of the virus is heavily obfuscated in code and not fully understood, but has been observed to use large-scale UDP scanning to build up a peer list of infected hosts and TCP for subsequent transfers of signed payloads. To make analysis more difficult, port numbers for connections are hashed from the IP address of each peer.
  
  Section::::Operation.:Payload propagation.:Armoring.
  
presuppositions: Computer data that spreads on its own is called a virus. 
corrections: Computer data that spreads on its own is called a worm. 
raw_presuppositions: Computer data that spreads on its own is called a virus.  One computer can spread a virus over LAN.
raw_corrections: Computer data that spreads on its own is called a worm.  If it spreads on its own, it would be a worm, not a virus.