Home

Up

Worms

Worms, unlike most viruses, do not infect other programs: they infect other computers.  The goal of most worms is to congest or shut down a network.  Many worms will not even affect an individual computer.

Worms take advantage of features in network connections that are otherwise extremely helpful to the user.  Worms use automated functions within a network, such as those in e-mails, to help spread themselves.   Because of this, worms usually rely little on human behavior to spread.  Worms attempt to spread as fast and far as possible so that when they are discovered they have already done a lot of damage.

There are two main types of worms; a host worm and a network worm.  The two differ in where their code is based. Host worms are based in an infected computer and uses network connections to transfer its code onto other computers.  A network worm, on the other hand, does not rely on a host machine.  It uses network connections to spread and run its various parts.

EXAMPLES

ExploreZip uses Microsoft Outlook and MAPI commands to replicate itself.  It takes addresses from the user's inbox and forwards itself to those addresses.  By doing this, it appears like the forward is coming from a person they know.  The worm also copies into the user’s directory and changes the WIN.INI file so that the worm program is launched each time windows is started.  The worm can also search the user’s hard drive and randomly destroy series of files.

In 1988, a virus called Morris’s Worm transferred from one computer to another over businesses' networks and quickly overflowed the networks with copies of itself.

 

The diagram below illustrates the interconnectedness of networks.  Initially, in Phase 1, the virus starts on only one machine.  Eventually it spreads all over without limits.

Phase One

 


Link to Computer Viruses Simplified