A computer worm is a type of malware whose primary function is to self-duplicate and infect other computers while remaining active on infected systems. In order spread to other computers, computer worm reproduce itself and it does this by exploiting vulnerabilities of an operating system invisible to the PC user. Computer worm can only be noticed when its replications have consumed the system resources hence causing the system to be very slow as well as causing other tasks to suspend.
There are different types of computer worms as follows:
i. Email worms: Email worms check contact list of the infected PC user then compose message containing execute file with an instruction deceiving the user to click on the file and then send this message to all addresses found on the PC user's contact list. Successful email worms usually use social engineering and phishing techniques to make users to open the attached file.
ii. File-sharing worms: File-sharing worms spread among computers by copying themselves into a public or shared folder in peer-to-peer file sharing networks. The most common tricks used by file-sharing worm developers is to disguise the worm as media files in order to enable the user open the file. The most popular file-sharing worm till date is the Stuxnet. Stuxnet is made up of worm and malware. The worm propagate malware through infected USB devices containing the host file while the malware targets supervisory control and data acquisition systems. File-sharing worms often target industrial environments, including power utilities, water supply services and sewage plants.
iii. Cryptoworms:
Cryptoworms work by encrypting data on the victim's system. Perpetrators can use this type of worm in ransomware attacks, where they follow up with the victim and demand payment in exchange for a key to decrypt the files. Some computer worms specifically target popular websites with poor security. If they can infect the site, they can infect a computer accessing the site. From there, internet worms spread to other devices that the infected computer connects to through the internet and private network connections.
iv. Instant messaging worms
Like email worms, instant messaging worms are hit by attachments or links, which the worm continues to propagate to the infected user's contact list the only difference is that instead of arriving in an email, it comes as an instant message on a chat service. If the worm hasn't had time to replicate itself onto the computer, the user can change their password on the chat service account to prevent its spread.
Computer worms often rely on weakness in networking protocols, such as File Transfer Protocol, to spread. After a computer worm loads and begins running on a newly infected system, it will typically follow its primary directive: to remain active on an infected system for as long as possible and spread to as many other vulnerable systems as possible. Malicious attackers can disguise a worm as a nonthreatening resource such as a work file or link, which a user clicks on or downloads that's only later revealed as a worm. Worms can contain malicious attachments, or payloads, that can delete files or let hackers remotely control users' computers.
While some computer worms require user action to initially propagate, such as clicking on a link, others can easily spread without user aid. All that's necessary is for the computer worm to become active on an infected system. Once active, the worm can spread over a network through its internet or local area network. Before the widespread use of networks, computer worms spread through infected storage media, such as floppy disks, which, when mounted on a system, would infect other storage devices connected to the infected system. Today, USB drives are a common vector for computer worms, as are internet activities such as email, chat and web surfing.
Good cybersecurity is essential to protect systems from computer worms. The following measures can help prevent the threat of computer worm infections:
- Install operating system updates and software patches.
- Use firewalls to protect systems from malicious software.
- Use antivirus software to prevent malicious software from running.
- Never click on attachments or links in emails or other messaging applications that might open systems to malicious software.
- Use encryption to protect sensitive data stored on computers, servers and mobile devices.
- Although some worms do nothing more than propagate to new victim systems most worms are associated with computer viruses, rootkits or other malicious software that can cause additional damage and risk.
Signs that indicates a worm might be present in your PC include the following symptoms:
- Computer performance issues over time, or limited computing bandwidth with no apparent explanation;
- The system freezing or crashing unexpectedly;
- Unusual system behavior such as programs that execute or terminate without user interaction;
- Unusual sounds, images or messages;
- The sudden appearance of unfamiliar files or icons, or the unexpected disappearance of files or icons warning messages from the operating system or antivirus software;
- Email messages sent to contacts that the user didn't send.
Removing a computer worm can be difficult. In extreme cases, the system might need to be formatted, requiring a user to reinstall all software. When beginning an incident response, security teams should use a known safe computer to download any required updates or programs to an external storage device and install them on the affected machine. If it is possible to identify the computer worm infecting the system, specific instructions or tools might be available to remove it without having to wipe the system entirely. Disconnect the system from the internet or any wired or wireless network before attempting to remove the computer worm. Also, remove non-permanent storage devices, such as a USB or external hard drive, and scan them separately for infection.
Note: Once the system is disconnected, do the following:
Update all antivirus signatures.
- Scan the computer with the up-to-date antivirus software.
- Use the antivirus software to remove any malware, malicious code and worms it finds, and clean infected files.
- Confirm that the operating system and all applications are up to date and patched.
- Organizations must protect their computer systems from worms because these programs can damage systems and compromise sensitive information.
- Security teams can regularly update antivirus software, use firewalls and encrypt sensitive information to reduce their organizations' worm infection risk.
- In addition, business leaders can train employees on security best practices to create a human firewall.