Computer Worm
A computer worm is self-replicating malware that uses a network to distribute copies of itself to other computers, often without user intervention. Unlike a virus, a worm does not need to attach itself to an existing program.
Updated
Overview
A worm is a self-contained program that can run independently and propagate a complete working version of itself onto other hosts on a network. NIST divides worms into two categories. A network service worm takes advantage of a vulnerability in a network service to spread and infect other hosts. A mass mailing worm is similar to an email-borne virus but is self-contained rather than infecting an existing file.
Worms are often designed to use up available resources such as storage space or processing time. They tend to spread very quickly and can cause a substantial impact in minutes or hours, so worm incidents often need a high-priority response.
Because network service worms exploit vulnerabilities, applying patches and disabling or removing unneeded network services reduce the ways a worm can spread. Network-based intrusion prevention systems can stop specific known threats such as network service worms, and network behavior analysis systems can identify worm activity from unusual traffic flows. For a fast-spreading worm, NIST advises containing the incident on most hosts as quickly as possible to limit the number of machines infected.
Similar Terms
2 termsComputer Virus
A virus inserts copies of itself into host programs or data files and is often triggered by user interaction, such as opening a file. A worm is self-contained, needs no host program, and usually executes itself without user intervention.
Trojan Horse
A trojan horse is a nonreplicating program that hides a malicious purpose behind a benign appearance. A worm replicates itself and spreads to other hosts across a network on its own.
Frequently Asked Questions
What is the difference between a virus and a worm?→
A virus spreads by inserting copies of itself into other programs or files and needs its host program to run. A worm is self-contained, does not attach to existing programs, and spreads copies of itself across a network, often without any user action.
How does a computer worm spread?→
Worms spread across networks. A network service worm exploits a vulnerability in a network service to infect other hosts, and a mass mailing worm spreads through email in a similar way to an email-borne virus.
How do you stop a computer worm?→
Prevention centers on patching vulnerabilities and disabling unneeded network services. Once a worm is spreading, NIST advises a containment strategy that covers most hosts as quickly as possible, which limits how many machines are infected and how much damage is done.
Related
Tool categories
Career roles
Glossary terms
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.