What is a computer worm?
A computer worm is malware that copies itself from system to system across a network with no host file and no user action. Once it runs on one machine, it looks for other reachable systems, exploits a vulnerability or a weak credential on them, copies itself over and starts again on each new host. That self-propagation is what separates a worm from other malware, and it is why a single infection can become hundreds or thousands in hours. Security texts usually say simply worm; this page uses computer worm to avoid confusion with WORM (write once, read many) storage, an unrelated backup and archiving technology.
How a worm spreads
Worms typically spread through one or more of these paths:
- Network service vulnerabilities in file sharing, remote access or web services that accept connections from other hosts.
- Weak or default credentials on services such as SMB, RDP, SSH or Telnet, which is how many IoT worms spread.
- Removable media and network shares that the worm copies itself to.
- Email and messaging, where the worm sends copies of itself from a compromised account.
Many worms also carry a payload, such as ransomware, a backdoor or bot software, so the spread and the damage are separate questions.
A real example: WannaCry
In May 2017, WannaCry spread worldwide by exploiting a vulnerability in Microsoft's SMBv1 implementation through an exploit known as EternalBlue, reaching Windows hosts over TCP port 445. It encrypted files on each machine it reached, combining worm propagation with a ransomware payload. Microsoft had released a patch two months earlier, so the victims were mostly unpatched systems still exposing SMBv1. The outbreak slowed after a researcher registered a domain the malware checked, which acted as a kill switch.
Indicators of a worm
Worm indicators are about scale and network noise rather than user activity:
- One host connecting to many others on the same port within seconds, such as TCP 445 across a whole subnet
- A sudden rise in network traffic, or saturated links and switches
- Many hosts showing the same new process or file within a short time
- Intrusion detection alerts for the same exploit from many internal sources
Containing and preventing worms
Containment starts with isolating infected hosts and segments so the worm cannot reach new targets, then patching the exploited vulnerability and cleaning or reimaging affected machines. Prevention follows the same logic: prompt patching, disabling legacy protocols such as SMBv1, network segmentation, host-based firewalls that block unneeded inbound services, strong unique credentials and intrusion prevention. User training helps little, because a worm needs no user to click anything.
Computer worm on the CompTIA Security+ exam
Worms fall under SY0-801 objective 2.5, which covers recognizing malware and other malicious activity from indicators. The deciding detail is self-propagation with no user action: infections spreading rapidly across many hosts, scanning on a single port or a fan-out from one source to a whole subnet. A virus is the classic distractor, because it needs a host file and a user to run it. A trojan relies on disguise and does not replicate, and a botnet describes many compromised hosts under remote control, which a worm can be used to build. For containment questions, the best answer is usually isolation, segmentation and patching rather than awareness training.