What is a computer worm?
Definition
A computer worm is a self-contained malware program that copies itself and spreads from computer to computer over a network, usually without anyone clicking anything.
- Category
- Attacks
- Also called
- cyber worm, worm, network worm, internet worm, Worm (computer worm)
- Last updated
A worm is a type of malware that spreads on its own. NIST's glossary defines it as a self-contained program that can propagate itself through data processing systems or computer networks. NIST's malware guidance adds that worms run without a host program and usually execute themselves without user intervention.
How worms spread
Network service worms exploit vulnerabilities in network services to infect other computers. Once a machine is infected, the worm scans for more machines with the same weakness and repeats. Because each copy finds new targets, a worm can reach a lot of devices quickly. Worms can also spread through email, shared drives and removable media, depending on how they were written.
Worm vs. virus
CISA draws the line this way: a virus usually needs a user action, such as opening an attachment or running a file, while a worm spreads without human interaction. A virus attaches to existing files. A worm stands alone.
What it can do
Some worms are built mostly to spread and use up storage or processing time, which can slow a network to a crawl. Others carry extra malicious code that steals data, installs other malware or gives an attacker control of the device.
Why it matters to you
A worm often gets in through software that hasn't been updated, so the problem isn't something you did wrong at the keyboard. A home router, an old laptop or a smart device that no longer gets patches can all be the entry point.
How to protect yourself
- 1
Install updates
Turn on automatic updates for your operating system, browser, apps and router firmware. Worms rely on known vulnerabilities that updates close.
- 2
Use a firewall and keep it on
Your operating system's built-in firewall and your router's firewall limit which services are reachable from outside.
- 3
Run antivirus and keep it current
Built-in tools such as Microsoft Defender are fine for most people. Run a full scan if a device acts strangely.
- 4
Retire unsupported devices
If a computer or device no longer gets security updates, replace it or keep it off your main network.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between a worm and a virus?
A virus needs a user to run or open something, and attaches itself to existing files. A worm is standalone and spreads over networks without human interaction.
Can a worm steal my data?
Some worms carry extra malicious code that does. Others mainly spread and slow systems down. Either way, treat an infection as serious.
How do I know if my computer has a worm?
Warning signs include unusual slowdowns, heavy network activity, programs you didn't install and security tools that stop working. Disconnect the device from the network and run a full scan, or ask a professional.
Sources
Something wrong or out of date? Tell us and we'll re-check it.