Worms are an advanced form of malware, compared to viruses, and have different goals in many cases. One of the main characteristics of worms is their inherent ability to replicate and spread across networks extremely quickly, as the previous Slammer example demonstrated. Most worms share certain features that help define how they work and what they can do:
- Do not require a host application to perform their activities.
- Do not necessarily require any user interaction, direct or otherwise, to function
- Replicate extremely rapidly across networks and hosts.
- Consume bandwidth and resources.
Worms can also perform some other functions:
- Transmit information from a victim system back to another location specified by the designer.
- Carry a payload, such as a virus, and drop off this payload on multiple systems rapidly.
With these abilities in mind, it is important to distinguish worms from viruses by considering a couple of key points:
- A worm can be considered a special type of malware that can replicate and consume memory, but at the same time it does not typically attach itself to other applications or software.
- A worm spreads through infected networks automatically and requires only that a host is vulnerable. A virus does not have this ability.