What Is a Computer Worm? How It Spreads, Removal & Best Protection (2026)
On Friday 12 May 2017, a ransomware strain that spread like a worm hit the NHS in England. The UK National Audit Office later found that at least 81 of 236 trusts were affected, and NHS England identified 6,912 cancelled appointments, with more than 19,000 estimated overall. Worms are not history, either. On 4 August 2026, Microsoft described a self-propagating worm hidden in more than 400 npm packages that stole developer credentials and republished infected updates. The names change, but the pattern holds: one weakness, one foothold, then automatic copying.
TL;DR
Definition: A computer worm is self-contained malware that copies itself across networks without attaching to a host file.
How it spreads: Through unpatched network services, shared files, email, removable drives, weak or stolen credentials, and software supply chains. Sharing Wi-Fi alone is not enough.
Why it is dangerous: Speed and scale. SQL Slammer infected most vulnerable hosts within about 10 minutes in 2003, and a worm can carry ransomware, data theft, or wiping tools.
Immediate response: Isolate the suspect device, keep evidence on business systems, and avoid reflexive wiping or shutdown.
Prevention: Patch quickly, close exposed services, segment networks, limit privileges, use MFA and endpoint detection, and keep tested offline backups.
Business view: Authorized testing of applications, APIs, and SaaS platforms can reveal weaknesses, but it does not replace patching, monitoring, or incident response.
Quick answer: What is a computer worm?
A computer worm is a self-contained malicious program that copies itself from one device to another across a network without attaching to a host file. It spreads by exploiting software flaws, weak or stolen credentials, shared files, or email, and it can deliver extra harm such as ransomware, data theft, or disruption.
 Know Where Your Business Is Exposed Security weaknesses are easier to fix before someone exploits them. If your business runs web applications, APIs, or SaaS products, a scoped security assessment can help identify applicable weaknesses and give your team clear remediation direction. Scope, deliverables, and quotes are agreed before any testing begins. |
Table of Contents
What Is a Computer Worm?
A computer worm is malware that copies itself to other systems on its own. NIST's glossary describes a worm as a self-contained program that can propagate itself through data processing systems or computer networks, and notes that worms often use up resources such as storage space or processing time. Another NIST source adds that a worm spreads across a network without needing a host program.
In plain words, a worm finds other computers it can reach, uses a weakness to get onto them, and runs there. Each new host then repeats the cycle. No person has to carry the worm from machine to machine, which is why worms can move far faster than most other malware. Worms belong to the wider malware family, alongside viruses, Trojans, and ransomware.
Technically, replication needs three things: code that can run on a target, a network path to that target, and a reason the target accepts the code. That reason is usually an unpatched service, a writable file share, or a valid password.
Propagation Is Not the Same as Payload
"Worm" describes how malware spreads, not what it does on arrival. SQL Slammer carried no malicious payload, yet it still overloaded networks and took database servers offline in January 2003. WannaCry added ransomware. NotPetya added destructive disk wiping. Worms in the npm ecosystem now steal developer credentials, a form of data leakage with serious downstream effects. Not every worm destroys data, but every worm turns one foothold into many.
Why Worms Do Not Need a Host File
A virus inserts itself into a program or file and waits for that host to run. A worm is a standalone program. For defenders, that means outbreaks follow network paths and trust relationships, not just infected documents.
How Do Computer Worms Work?
Most worms follow one loop. The table below is a conceptual lifecycle, not a description of any single malware family, and it shows where defenders can break the chain. MITRE ATT&CK describes the middle steps as lateral movement, including exploitation of remote services and lateral tool transfer, where files are copied between systems over protocols such as SMB or RDP.
Stage | What happens | Where defenders can interrupt |
1. Entry | The first copy arrives through a software flaw, stolen password, email attachment, removable drive, or poisoned update. | Patching, email filtering, MFA, application control |
2. Discovery | The worm looks for reachable hosts, shares, or accounts. | Segmentation, egress filtering, scan detection |
3. Access path | It finds a usable weakness, such as a vulnerable service or reused password. | Vulnerability management, unique credentials |
4. Replication | It copies itself to the new host. | Host firewalls, SMB restrictions, EDR |
5. Execution | The copy runs on the new host. | Application allowlisting, EDR |
6. Repeat | The new host starts the same cycle. | Fast isolation and containment |
7. Payload (optional) | It may steal data, encrypt files, wipe disks, or install other malware. | Tested backups, monitoring, incident response |
The first row needs care. A worm does not always arrive alone. A person may open an attachment, an attacker may use a stolen password, or a vulnerable service may sit exposed to the internet. Once the first copy runs, spreading can become automatic. Good network security aims to break the loop at several points instead of betting on one control.
How Do Computer Worms Spread?
Two stages are easy to confuse. Initial infection is how the first copy enters an environment. Self-propagation is how that copy reaches other systems. A phishing email may cause the first, while an exposed file-sharing service enables the second. Defense must cover both.
Route | What it needs | Possible signs | Main defenses |
Vulnerable network service | A reachable, unpatched service such as SMB, RDP, or a web server | Service crashes, scanning, new processes | Patching, closed ports, segmentation |
Email and attachments | A user opens a file or link, or address-book abuse | Odd messages sent from real accounts | Mail filtering, macro blocking, training |
File shares | Writable shares and broad permissions | New or renamed files on shares | Least privilege, SMB limits |
Removable media | Autorun, or a user opening infected files | Hidden files on USB drives | Disable autorun, device control |
Credential reuse | Weak, reused, or stolen passwords or tokens | Logins from unusual hosts | MFA, unique passwords, token rotation |
IoT and exposed devices | Default passwords or old firmware | Devices scanning other hosts | Change defaults, update, isolate |
Stolen publishing tokens or build access | Unexpected package versions | Pin versions, rotate tokens, review provenance |
Network Services and Unpatched Systems
The most dramatic worms exploited flaws in network services. Code Red used a web server flaw, Slammer a database flaw, and Conficker and WannaCry flaws in Windows services. CISA's guidance tells organizations to disable SMBv1, block TCP port 445 at the internet perimeter, and limit internal SMB traffic, because attackers use SMB to propagate malware. Most workstations never need to talk to other workstations over SMB.
Credentials, Email, Shares, and Removable Drives
US-CERT reported that Conficker spread through unpatched servers, network shares, and thumb drives. Email worms use address books to send themselves onward. Credential reuse lets a worm log in instead of exploiting anything. Disable autorun, restrict shares, and pair unique passwords with MFA.
IoT, Cloud, and Developer Pipelines
Connected devices often ship with default passwords. CISA's 2016 alert on Mirai noted that it scanned for IoT devices using a short list of 62 default credentials. Mirai is a botnet, but its scan-and-infect pattern is worm-like. In cloud and hybrid environments, flat networks and loose permissions recreate the same problem. See our guides to cloud security, hybrid cloud, and isolating workloads in a virtual private cloud.
Software pipelines are the newest route. The Shai-Hulud worm compromised more than 500 npm packages in 2025, and a variant returned in 2026 (covered below). Teams that run modern DevOps pipelines should treat publishing tokens as high-value secrets.
Does Sharing Wi-Fi Spread a Worm?
Not by itself. Joining the same network as an infected device does not automatically infect yours. A worm still needs a reachable weakness: a vulnerable service, a writable share, a reused password, or a risky file you run. A flat network, where everything can reach everything, raises the stakes.
 Could a Hidden Weakness Create a Wider Security Risk? A weakness in an exposed application or API can give attackers a path into connected systems. That is different from worm propagation, but both reward early discovery. Articsledge can discuss a scoped assessment of your web applications, APIs, or SaaS platform, with testing limits and deliverables agreed in writing first. |
Types of Computer Worms
Worms are usually grouped by how they spread. The categories overlap, and modern worms often combine several.
Network-service worms exploit a flaw in a listening service. Code Red, Slammer, and Conficker belong here.
Email worms send copies to contacts, often as attachments or links.
File-sharing worms copy themselves to writable shares or shared folders.
Messaging and social worms spread through links sent over chat or social platforms.
Removable-media worms use USB drives, often through autorun.
Internet and IoT worms scan for devices with weak credentials or old firmware.
Credential-enabled worms log in with stolen or guessed secrets, such as the token-stealing npm worms of 2025 and 2026.
Supply chain worms spread through package registries, build systems, and developer tools.
One worm can fit several labels. Conficker used a network-service flaw and removable drives. ChainDrop combined stolen tokens with package registries.
Computer Worm vs. Virus vs. Trojan vs. Ransomware
These terms describe different things, which is why they get mixed up. Worm, virus, and Trojan describe how malware spreads or arrives. Ransomware describes a goal: locking files for ransom.
Malware | Copies itself? | Needs a host file or user action? | Main purpose |
Worm | Yes, across systems on its own | No host file; first entry may need an action | Spreading (payload varies) |
Virus | Yes, by infecting files or programs | Needs a host program to run | Varies, often damage |
Trojan | No | Relies on a user installing it | Disguise, then access or theft |
Ransomware | Not by itself | Depends on the delivery method | Lock files for ransom |
Is a Computer Worm a Virus?
Strictly, no. NIST defines a virus as malware that spreads by inserting copies of itself into other programs or files and that needs its host program to run. A worm spreads as a standalone program. People still say "worm virus" because both are malware, and some threats combine traits from several categories.
Where Ransomware and Worms Overlap
WannaCry is ransomware with a worm-like mechanism: MITRE records that it used an SMBv1 exploit to spread to other systems. That does not make every ransomware strain a worm. MITRE notes that LockerGoga moved across networks because operators copied files by hand, not through self-propagation.
Famous Computer Worms and Real-World Attacks
Each outbreak teaches a practical lesson, and many exploited flaws that already had fixes.
Worm | Year | How it spread | Main lesson |
Morris | 1988 | Flaws in Unix network software and weak passwords | Trust-based networks need security |
Code Red | 2001 | IIS web server flaw (MS01-033) | Apply patches quickly |
SQL Slammer | 2003 | One UDP packet to SQL Server | Speed beats manual response |
Conficker | 2008 | Windows flaw MS08-067, shares, USB drives | Patch and disable autorun |
WannaCry | 2017 | SMBv1 flaw fixed by MS17-010 | Unsupported systems and open ports are risky |
NotPetya | 2017 | Poisoned update, SMB exploits, admin tools | Supply chain and internal spread combine |
ChainDrop | 2026 | Stolen npm tokens, republished packages | Guard publishing credentials |
Morris worm (1988). On 2 November 1988, a Cornell graduate student released it. Purdue's summary estimates it hit around 6,000 of the roughly 60,000 computers then connected. It showed how fragile a trust-based network could be.
Code Red (2001) and SQL Slammer (2003). CAIDA measured more than 359,000 Code Red infections on 19 July 2001. Slammer hit on 25 January 2003 through a flaw in SQL Server, a popular database management system. Its payload fit in a single 404-byte UDP packet, infection doubled about every 8.5 seconds, and over 90 percent of vulnerable hosts fell within 10 minutes. Slammer caused cancelled flights and ATM failures even without a malicious payload.
Conficker (2008). First seen in November 2008, it exploited MS08-067 and spread through shares and removable drives. A retrospective by a Microsoft malware responder says millions of computers were eventually infected.
WannaCry (2017). Released on 12 May 2017, it spread through an SMBv1 flaw. Microsoft had issued MS17-010 on 14 March 2017. The NAO found infected NHS organizations had unpatched or unsupported Windows systems, and that managing internet-facing firewalls would also have protected them. A researcher's kill switch limited the damage.
NotPetya (2017). On 27 June 2017, a poisoned update to Ukrainian accounting software called M.E.Doc delivered NotPetya. MITRE says it spread with the SMBv1 exploits EternalBlue and EternalRomance, and calls it more accurately wiper malware than ransomware.
Worms in 2026: The Supply Chain Era
Self-propagating code now targets developers. On 4 August 2026, Microsoft reported ChainDrop, a Mini Shai-Hulud variant found in more than 400 npm packages. It runs from an npm preinstall hook, searches workstations and build systems for npm, GitHub, cloud, and infrastructure credentials, then uses stolen npm tokens to download a publisher's packages, add itself, raise the patch version, and republish. Microsoft also says it can write files into Claude and Visual Studio Code configuration paths in repositories, creating another infection route; see our guide to agentic AI security. Microsoft's advice: treat any workstation or build runner that installed an affected package as potentially compromised, rotate credentials from a known-clean environment, and rebuild affected systems from trusted sources.
What Devices Can Computer Worms Infect?
Any device that runs code and connects to a network can host a worm. Real risk depends on exposure, patch level, privileges, and configuration, not on the brand of the operating system.
Windows: The best-known worms targeted Windows services such as SMB. That history reflects exposed services and market share, not safety elsewhere.
macOS: Apple builds in layers: App Store or Gatekeeper with notarization, plus XProtect for detection and cleanup. These reduce risk, but no system is immune.
Linux and servers: MITRE lists exploitation of remote services as a technique on Windows, Linux, macOS, and ESXi. Servers hold data and reach other systems, so they are valuable targets.
Phones and tablets: Worm-style spread is less common because mobile systems sandbox apps, but malicious links and old software still matter. Keep Android and iOS updated and use official app stores.
IoT devices: Cameras, routers, and recorders with default passwords and old firmware are easy targets, as Mirai showed. Connected vehicles raise the stakes; see automotive cybersecurity.
Virtual machines and cloud: Hypervisors, management consoles, and misconfigured resources can become spreading points. See cloud-native security, containerization, and Kubernetes.
Start with an inventory. You cannot patch or segment devices you do not know about.
Signs of a Computer Worm Infection
Signs are clues, not proof. Many have harmless causes, such as a large update, a backup job, or a failing disk. A cluster of signs across several machines is more worrying than one slow laptop.
Unexplained network traffic, or one device making many connection attempts to other hosts
Sudden slowdowns, high CPU use, or full disks with no clear cause
Antivirus or EDR alerts that repeat, or appear on several devices within a short time
Unknown processes, services, or scheduled tasks, especially ones that survive a restart
Strange account activity: logins from odd hosts, new privileged accounts, or lockouts
Messages sent from your accounts that you did not write
Unfamiliar files on network shares, or hidden copies on removable drives
Security tools that stop updating or refuse to open
CISA's checklist lists further enterprise signals, such as unexpected PowerShell use, remote-management software, and endpoint-to-endpoint traffic. Send logs to a central place so you can compare machines; our overview of cloud telemetry explains the basics. If several signs appear together, isolate first and investigate second.
What to Do Immediately If You Suspect a Worm
Speed matters, but so does care. The goal is to stop spreading while keeping the evidence and the systems you need.
Home Users
Disconnect the suspect device from Wi-Fi and Ethernet. Do not keep browsing or typing passwords on it.
Do not download "cleaner" tools from pop-ups or search ads.
From a different, trusted device, change important passwords and turn on MFA.
Copy only essential personal files to external storage if you must, and scan them before reuse.
Run a full scan with your built-in or a reputable security tool, then follow the removal steps below.
Businesses
Activate your incident response plan and name an incident lead.
Isolate affected systems. CISA advises taking the network offline at the switch level when several systems or subnets are affected, and prioritizing critical systems.
Use out-of-band communication, such as phone calls, because attackers may be watching email.
Avoid powering devices off unless you cannot disconnect them. Shutdown destroys volatile evidence, such as what RAM holds.
Capture images and logs from a sample of affected systems before cleanup.
Do not delete suspicious files or wipe machines until you have scoped the incident and kept what investigators need.
Reflexive wiping can destroy clues and may not fix the cause. If the business depends on the affected systems, bring in qualified incident responders early.
How to Remove a Computer Worm Safely
Removal is not one scan. It is a sequence, and the order matters. Use these steps for a home PC or as the technical core of a business response.
Contain. Disconnect the device from every network and detach shared drives.
Find the scope. Check other devices, shares, and accounts that talked to the suspect machine.
Protect data and evidence. Keep only essential, scanned copies of files. On business systems, preserve images and logs first.
Use trusted protection. Update your built-in or a reputable security product from its official source. Never download tools from random links.
Scan fully, then scan offline. A full scan finds known threats. An offline scan checks from outside the running system and can catch stubborn malware.
Check persistence. Look for unknown services, scheduled tasks, startup items, and new accounts. Let your security product or responders clean them instead of editing the registry by hand.
Close the entry route. Install missing updates, disable exposed services, and remove default or reused passwords. Otherwise the worm can return.
Secure accounts from a clean device. Change passwords and revoke tokens only from a trusted device, because malware may capture new passwords.
Check everything connected. Scan other devices and shared storage.
Decide on reimaging. If you cannot establish that the system is clean, or it handles sensitive data, rebuild it from a trusted image. A clean scan is not proof of a clean system.
Restore verified-clean data. Restore from backups made before the infection and scan them first. See backup as a service and disaster recovery as a service.
Monitor. Watch for repeat alerts, odd traffic, and failed updates for several weeks.
Windows: Run a Microsoft Defender Offline Scan
Microsoft documents a scan that boots into a trusted environment outside the normal Windows kernel, which helps with rootkits and boot-level malware. It needs x64 Windows 11 or x64 or x86 Windows 10, and it does not apply to Windows Server or ARM devices. If BitLocker protects the system drive, suspend it first or you may be asked for the recovery key. Windows Recovery Environment must be enabled, and you need local administrator rights.
Open Windows Security, select Virus & threat protection, then Scan options.
Choose Microsoft Defender Offline scan and select Scan now.
Save your work, confirm the prompts, and let the PC sign out and restart.
The scan takes about 15 minutes. Windows then loads normally, and results appear under Protection history.
Mac: Rely on Apple's Layers, Then Verify
Apple says macOS blocks known malware through Gatekeeper, notarization, and XProtect, and that XProtect can remove malware when Apple delivers updated information. By default, macOS checks for XProtect updates daily. Install the latest macOS update, do not bypass Gatekeeper warnings, and remove apps you do not recognize. Apple notes XProtect does not restart the Mac for you, so restart when prompted. For business Macs, use a managed endpoint tool and treat any confirmed infection as an incident.
When Tools Are Not Enough
Call professional incident responders if the worm touched business systems, handled sensitive data, spread across many devices, or keeps returning. Removal tools help, but they cannot prove that attackers left no other access.
How Businesses Contain Network Worm Outbreaks
A worm outbreak is an incident-command problem, not just an antivirus problem. CISA's guide groups the work into detection and analysis, reporting, containment and eradication, and recovery. A practical sequence:
Command and communications. Name incident, technical, and communications leads, and use out-of-band channels. If you operate in the EU, check incident-reporting duties under frameworks such as NIS2.
Telemetry. Pull EDR alerts, firewall logs, DNS logs, and identity logs. Strong cloud operations practice makes this faster.
Isolation. Isolate in a coordinated way, critical systems first, and block the spreading protocol, such as internal SMB, while you work.
Identity review. Look for new privileged accounts, odd VPN logins, and reused service-account passwords. CISA advises resetting passwords for affected systems once the environment is rebuilt and clean.
Evidence. Capture images and memory from a sample of hosts before rebuilding.
Close the hole. Patch or disable the entry route on every host, not just infected ones.
Rebuild and restore. Rebuild from golden images or infrastructure as code templates, then restore from offline, encrypted backups you have tested.
Validate and learn. Reconnect in stages using only clean systems, confirm the fix worked, and document lessons for the next plan.
Incident Response or Penetration Testing?
During an active outbreak you need incident responders, not a penetration test. Testing is a later assurance activity. After the incident, authorized testing can check whether specific weaknesses were actually closed.
How to Prevent Computer Worms
No single control stops every worm. Layer controls and know what each one does: prevent, detect, contain, or recover. Backups are the clearest example: they help you recover, but they do not stop an infection.
Control | Main job | Home users | Businesses |
Patching and supported systems | Prevent | Turn on automatic updates; retire unsupported devices | Asset inventory, patch deadlines, emergency patch path |
Remove exposed services | Prevent | Keep router admin and remote access off the internet | Close unused ports; disable SMBv1; limit RDP |
Segmentation | Contain | Separate guest and IoT Wi-Fi | Isolate servers, users, and sensitive systems |
Least privilege and MFA | Prevent, contain | Standard user account; MFA on email | Separate admin accounts; phishing-resistant MFA |
Endpoint protection and EDR | Prevent, detect | Built-in antivirus kept current | Centrally managed EDR with alerting |
Email and web filtering | Prevent | Be careful with attachments | Gateway filtering, macro blocking, DMARC |
Logging and monitoring | Detect | Review security alerts | Central logs and tested alerts |
Offline, tested backups | Recover | Backup drive disconnected after use | Offline, encrypted, restore-tested |
Patching deserves first place. Code Red, Slammer, Conficker, and WannaCry all hit systems with known fixes available. Patching is ongoing work with a real cost, which is why budgeting for software maintenance matters. Segmentation limits how far a worm travels once inside; CISA says it can contain intrusions and limit lateral movement, though user error can defeat it. For policy and ownership, see our guide to cloud governance and the cloud landing zone design that builds in identity, networking, and logging.
Computer Worm Prevention Checklist for Businesses
Give each item an owner and a way to verify it. The timeframes are illustrative, not a compliance requirement.
Immediate Priorities
Inventory: The IT lead lists every device, server, and cloud resource. Verify that it matches a network scan.
Emergency patches: IT operations patch internet-facing systems and known exploited vulnerabilities first. Verify with a scanner.
Close exposure: The network team blocks inbound SMB at the perimeter, removes exposed RDP, and disables SMBv1. Verify with an external scan.
Backups: The infrastructure lead keeps an offline copy. Verify with a restore test.
First 30 Days
Segment servers from workstations and from guest or IoT networks.
Enforce MFA on email, VPN, admin, and cloud accounts.
Remove default passwords and unused accounts.
Deploy EDR or confirm coverage.
Write and rehearse a one-page worm response plan.
Ongoing Practice
Review patches monthly and access rights quarterly.
Schedule authorized assessments of applications and APIs around releases.
Run restore tests and tabletop exercises.
Review the software supply chain: pin dependencies, rotate tokens, and limit publishing rights.
 Turn Security Priorities Into Actionable Findings A prevention checklist tells you what to fix. A scoped assessment shows which weaknesses in your supported systems matter most. Expect findings, severity explanations, and remediation recommendations in an agreed report. It complements patching, endpoint protection, and incident response; it does not replace them. |
Can Penetration Testing Help Reduce Worm-Related Risk?
Sometimes, within limits. A penetration test is an authorized attempt to find and validate weaknesses in an agreed system. Articsledge describes its penetration testing services as scoped work on web applications, APIs, and SaaS platforms, plus vulnerability assessments and remediation verification. Cloud security assessments are also listed, with suitability confirmed during scoping, and scope and deliverables are agreed before testing begins.
What it can do. It can expose weak authentication, broken access control, and misconfiguration in applications and APIs that attackers might use as a foothold. It can show which findings matter most. Through retesting, it can confirm that specific fixes worked. Our penetration testing guide covers types, process, and costs.
What it cannot do. It cannot guarantee that every weakness is found, because it is limited by scope, time, access, and the state of the system on the test day. It does not replace patch management, EDR, monitoring, incident response, or malware removal. Articsledge's published focus is applications, APIs, and SaaS, so a review of worm spread across an internal Windows network may need a different provider. Articsledge says it confirms whether an engagement fits before accepting it. For AI-assisted approaches, see AI penetration testing.
When Should a Business Commission Security Testing?
Consider testing when:
You are about to launch a new application or major release.
You expose a new API or change how an existing one is used.
You are changing architecture, such as a cloud migration or a new integration.
A customer or procurement team asks for security evidence, which is common for B2B SaaS companies.
You have unresolved findings and need to verify the fixes.
You want assurance after an incident, once the environment is stable.
Do something else first if you have no patching process, need malware removal, or need a compliance certification. Articsledge's service page notes that a penetration test does not automatically establish compliance.
How to Prepare a Useful Request
Your business goal and deadline
Systems in scope and out of scope
Written authorization and rules of engagement
Technical details such as stack, user roles, and test accounts
Expected deliverables: executive summary, technical findings, remediation advice
Retesting needs
A budget expectation, since pricing is scope-based
The provider's relevant expertise and availability
Do not send passwords or production credentials in a first inquiry. When ready, contact Articsledge or read about the team. Teams building their own software may also like our guide to custom web application development.
Common Myths About Computer Worms
Myth: Worms and viruses are the same. Fact: A virus needs a host program. A worm is standalone.
Myth: Worms only infect Windows. Fact: Exploitation of remote services affects Windows, Linux, macOS, and ESXi, according to MITRE.
Myth: Every worm needs a click. Fact: Some spread through a vulnerable service with no click, although the first entry sometimes needs one.
Myth: Antivirus alone is enough. Fact: It is one layer. Patching, segmentation, and backups matter too.
Myth: A clean scan proves the device is safe. Fact: It shows no known threat was found, not that no access remains.
Myth: Home networks are always safe. Fact: Default passwords and old router firmware create real risk.
Myth: A firewall is enough. Fact: Worms also spread from inside, through email, stolen credentials, and software supply chains.
Myth: Penetration testing guarantees security. Fact: It is a point-in-time assessment within an agreed scope.
 Fixed the Findings? Verify What Changed. After your team fixes reported weaknesses, retesting can check whether specific findings were actually resolved. Articsledge can discuss remediation verification where specialist availability and technical arrangements allow. Retesting confirms agreed findings at a point in time; it is not a guarantee that no weaknesses remain. |
Frequently Asked Questions About Computer Worms
What is a computer worm in simple terms?
A computer worm is malware that copies itself to other devices over a network without needing a host file. It finds reachable systems, uses a weakness such as an unpatched service or reused password, and repeats. Some worms only spread, while others also carry ransomware or data-stealing tools.
Is a computer worm a virus?
Not strictly. A virus spreads by inserting itself into other programs or files and needs that host to run. A worm is standalone and spreads over networks. Both are malware, which is why people mix the terms, and some malware combines features of several categories.
Can a worm spread without anyone clicking anything?
Yes, once it is running. A worm can scan for and exploit a vulnerable service on other machines with no user action. The first infection may still need a click, a stolen password, or an exposed service, so not every infection is zero-click.
Can computer worms spread through Wi-Fi?
Sharing Wi-Fi does not infect a device by itself. A worm needs a reachable weakness, such as a vulnerable service, open share, default password, or a risky file you run. Separating guest and IoT devices from your main devices lowers the risk.
Can a Mac get a worm?
Yes. No operating system is immune. macOS includes Gatekeeper, notarization, and XProtect, which reduce risk, but exposed services, outdated software, stolen credentials, and risky downloads can still cause infection. Keep macOS updated and do not bypass security warnings.
Can phones and tablets get worms?
It is possible but less common than on PCs and servers. Mobile systems sandbox apps and rely on official stores, yet malicious links, outdated software, and risky apps still matter. Keep the operating system updated and install apps only from official sources.
What are the first signs of a worm infection?
Common clues include unexplained network traffic, repeated connection attempts, slowdowns, new processes or scheduled tasks, odd account activity, and repeated security alerts across several devices. These are clues, not proof, because updates and backups can cause similar symptoms.
Can antivirus software remove a computer worm?
Often it can remove known worms, but it cannot prove the system is fully clean, and it does not close the weakness the worm used. Use updated security software, run an offline scan where available, patch the entry route, and rebuild the system if trust is uncertain.
How long does worm removal take?
It varies. A Microsoft Defender Offline scan takes about 15 minutes, but full removal includes scoping, patching, account recovery, and checking other devices, which can take hours or days. Business outbreaks can take longer.
Can a worm steal passwords or data?
Yes, if its payload includes that. Propagation and payload are separate. The 2026 ChainDrop worm searched developer machines and build systems for credentials. After removal, change passwords from a clean device and revoke exposed tokens.
What is the difference between a worm and a Trojan?
A worm copies itself across systems on its own. A Trojan pretends to be useful software and relies on a user to install it; it does not self-replicate. A worm can carry a Trojan as a payload, so the categories can overlap.
Is WannaCry a computer worm?
WannaCry is best described as ransomware with worm-like spreading. MITRE records that it used an SMBv1 exploit to reach other systems on a network. Not every ransomware strain spreads this way. The NAO found infected NHS organizations had unpatched or unsupported Windows systems.
Can a USB drive spread a worm?
Yes. US-CERT reported that Conficker could spread from thumb drives. Disable autorun, scan unfamiliar drives, restrict removable media on business devices, and never plug in drives of unknown origin.
What should a business do after discovering a worm?
Activate the incident response plan, isolate affected systems in a coordinated way, preserve evidence, scope the spread, close the entry route, reset affected credentials from clean devices, and rebuild or restore from tested backups. Bring in incident responders for serious cases.
Can penetration testing help reduce worm-related risk?
It can help find weaknesses in applications, APIs, and SaaS systems within an agreed scope, and retesting can confirm fixes. It cannot guarantee finding every weakness, and it does not replace patching, monitoring, endpoint protection, or incident response.
Key Takeaways
A worm is standalone and self-replicating. A virus attaches to a host, and ransomware describes a payload.
Spread needs a path: an unpatched service, shares, credentials, email, removable media, or stolen publishing tokens.
Many famous worms hit systems that already had fixes. Code Red had a patch a month earlier, and WannaCry's fix, MS17-010, was released on 14 March 2017.
In 2025 and 2026, supply chain worms such as Shai-Hulud and ChainDrop moved to developer credentials and package registries.
When you suspect a worm, isolate first, preserve evidence on business systems, and avoid reflexive wiping.
A clean scan is not proof of a clean system. Rebuild when trust is uncertain.
Layer your defenses. Backups help recovery but do not prevent infection.
Testing is assurance for applications, APIs, and SaaS. It is not emergency response and it guarantees nothing.
Actionable Next Steps
Home users: Turn on automatic updates, replace default router and device passwords, enable MFA, and keep one offline backup.
Home users: If something looks wrong, disconnect the device and follow the removal steps above.
Small organizations: Inventory your devices, patch internet-facing systems first, close inbound SMB and RDP, and enforce MFA.
Small organizations: Test one backup restore this month.
Security and IT teams: Segment networks, deploy EDR, centralize logs, and rehearse a worm playbook.
Security and IT teams: Review developer pipelines. Pin dependencies, rotate publishing tokens, and limit install scripts where practical.
Businesses with applications, APIs, or SaaS: When a release, customer review, or remediation check justifies it, define a scope and ask about Articsledge's penetration testing services.
Glossary
Worm: Self-contained malware that copies itself across systems without a host file.
Virus: Malware that spreads by inserting itself into other programs or files.
Malware: Software designed to harm systems, steal data, or disrupt operations.
Trojan: Malware disguised as useful software that does not self-replicate.
Ransomware: Malware that locks files and demands payment.
Vulnerability: A flaw that an attacker can use.
Exploit: Code or a technique that uses a vulnerability.
Payload: What malware does after it arrives.
Lateral movement: An attacker or malware moving from one system to others inside a network.
SMB: Server Message Block, a Windows file- and printer-sharing protocol.
Segmentation: Dividing a network into zones to limit spread.
EDR: Endpoint detection and response, which monitors devices for suspicious behavior.
Containment: Stopping an incident from spreading further.
Reimaging: Rebuilding a system from a trusted image.
Penetration testing: Authorized testing that tries to find and validate weaknesses.
Remediation: Fixing a weakness.
Retesting: Checking that specific fixes worked.
Botnet: A network of infected devices controlled by an attacker.
Sources & References
All links were accessed on 12 November 2026.
NIST CSRC. worm, Glossary. Undated.
NIST CSRC. virus, Glossary. Undated.
MITRE. Exploitation of Remote Services, T1210. Last modified 4 August 2026.
MITRE. Lateral Tool Transfer, T1570. Last modified 3 September 2026.
MITRE. WannaCry, S0366. Undated.
MITRE. NotPetya, S0368. Undated.
CISA and partners. #StopRansomware Guide. September 2023.
Microsoft. Run and review the results of a Microsoft Defender Offline scan. Updated 3 July 2026.
Apple. Protecting against malware in macOS. Apple Platform Security. 19 December 2024.
UK National Audit Office. Investigation: WannaCry cyber attack and the NHS. 27 October 2017.
CAIDA. The Spread of the Sapphire/Slammer Worm. 2003.
CAIDA. Code-Red: a case study on the spread and victims of an Internet worm. 2002.
US-CERT. Conficker Worm Targets Microsoft Windows Systems. 29 March 2009.
Help Net Security. Conficker: A 10-year retrospective on a legendary worm. 21 November 2018.
CISA. Petya Ransomware, TA17-181A. 1 July 2017.
US-CERT. Heightened DDoS Threat Posed by Mirai and Other Botnets, TA16-288A. 14 October 2016.
CISA. Widespread Supply Chain Compromise Impacting npm Ecosystem. 23 September 2025.
Microsoft Security Research. ChainDrop supply chain compromise: Anatomy of a self-propagating worm. 4 August 2026.
Purdue University. Do you know what the Morris worm is? 23 July 2024.
Articsledge. Penetration Testing Services for Businesses. Reviewed for service scope.
