What is a computer worm?
Computer worms are among the most common types of malware.
They spread over computer networks by exploiting operating system
vulnerabilities. Worms typically cause harm to their host networks by
consuming bandwidth and overloading web servers. Computer worms can also
contain “payloads” that damage host computers. Payloads are pieces of
code written to perform actions on affected computers beyond simply
spreading the worm. Payloads are commonly designed to steal data
or delete files. Some payloads even create backdoors in host computers
that allow them to be controlled by other computers. Malicious parties
can use networks of these infected computers (“botnets”) to spread spam
and perform denial-of-service attacks.
Computer worms are classified as a type of computer virus, but there
are several characteristics that distinguish computer worms from regular
viruses. A major difference is the fact that viruses spread through
human activity (running a program, opening a file, etc) while computer
worms have the ability to spread automatically without human initiation.
In addition to being able to spread unassisted, computer worms have the
ability to self-replicate. This means that worms can create multiple
copies of themselves to send to other computers. This often happens
through the sending of mass emails to infected users’ email contacts.
Computer Worm
What is a computer worm?
Computer worms are among the most common types of
malware.
They spread over computer networks by exploiting operating system
vulnerabilities. Worms typically cause harm to their host networks by
consuming bandwidth and overloading web servers. Computer worms can also
contain “payloads” that damage host computers. Payloads are pieces of
code written to perform actions on affected computers beyond simply
spreading the worm. Payloads are commonly designed to
steal data
or delete files. Some payloads even create backdoors in host computers
that allow them to be controlled by other computers. Malicious parties
can use networks of these infected computers (“botnets”) to spread spam
and perform denial-of-service attacks.
Computer worms are classified as a type of computer virus, but there
are several characteristics that distinguish computer worms from regular
viruses. A major difference is the fact that viruses spread through
human activity (running a program, opening a file, etc) while computer
worms have the ability to spread automatically without human initiation.
In addition to being able to spread unassisted, computer worms have the
ability to self-replicate. This means that worms can create multiple
copies of themselves to send to other computers. This often happens
through the sending of mass emails to infected users’ email contacts.
Computer Worm Examples
Computer worms have caused billions of dollars in damages over the
past decade. Today, the Stuxnet, Duqu, and Flame computer worms continue
to make headlines as a new breed of malware: computer worms designed
for cyber warfare.
The
Stuxnet virus
is a computer worm discovered in June 2010. Stuxnet was created by the
United States and Israel, targeting Iran’s Uranium Enrichment Program.
Stuxnet was created as part of a top-secret cyber war program codenamed
“Olympic Games.” The computer worm crashed 984 centrifuges at Iranian
nuclear power plants between 2008 and 2012, setting back nuclear weapon
production capabilities in Iran by about two years.
The Duqu computer worm was discovered in September 2011 and is
believed to be linked to the Stuxnet virus. Duqu and Stuxnet operate
very similarly and were both created by governments to target nuclear
production in Iran. Rather than being used to disrupt the production of
nuclear weapons, Duqu was used for stealing information. Some versions
of Duqu did include a payload capable of deleting files from the host’s
computer.
The Flame virus was discovered in 2012 and is regarded as one of the
most sophisticated computer worms ever found. Flame’s code shares many
similarities with the Stuxnet code, and Flame, like Stuxnet, was
designed as part of a government-sponsored cyber program. While the
Stuxnet computer worm was designed to sabotage nuclear weapon
production, Flame is believed to have been created purely for cyber
spying. Flame has infected thousands of computers since its deployment,
mostly in Iran and other Middle Eastern countries.
Protecting yourself from Computer Worms
There are several best practices users can follow to protect their computers from worms. Following these steps will not only
decrease the risk of infection, but also provide for easier detection and computer worm removal.
- Keep the computers’ operating system and software up-to-date with
vendor-issued security releases. These updates often contain security
patches designed to protect computers from newly discovered worms.
- Avoid opening emails that you don’t recognize or expect, as many computer worms spread via email.
- Refrain from opening attachments and clicking on links from untrusted/unfamiliar sources.
- Run a firewall and antivirus software to be further protected from
computer worms. Software firewalls will keep the computer protected from
unauthorized access. Choose an antivirus program that includes download
scanning functionality (to detect malicious content in email and web
downloads) as well as malware removal tools.
Symptoms of a Computer Worm
Users should be familiar with the symptoms of a computer worm so that
they can quickly recognize infections and begin the process of computer
worm removal. Here are some of the typical symptoms of a computer worm:
- Slow computer performance
- Freezing/crashing
- Programs opening and running automatically
- Irregular web browser performance
- Unusual computer behavior (messages, images, sounds, etc)
- Firewall warnings
- Missing/modified files
- Appearance of strange/unintended desktop files or icons
- Operating system errors and system error messages
- Emails sent to contacts without the user’s knowledge
While other issues can cause these symptoms, the appearance of
multiple symptoms from this list or the repeated occurrence of certain
symptoms usually indicates that the computer has been infected with a
worm.
Computer Worm Removal
There are several steps that should be taken for computer worm
removal. It is important to disconnect the computer from the internet
and any local area networks before taking any other actions for worm
removal. In order to prevent spreading of the worm, use a non-infected
computer to download any updates or programs required and then install
them on the infected machine via an external storage device. Once the
computer is disconnected:
- Check that all antivirus signatures are up-to-date.
- Scan the computer with antivirus software.
- If the scan detects a computer worm or other malware, use the
software to remove malware and clean or delete infected files. A scan
that detects no malware is usually indicative that symptoms are being
caused by hardware or software problems.
- Check that the computer’s operating system is up-to-date and all software and applications have current patches installed.
- If a worm is difficult to remove, check online for specific computer worm removal utilities.