A Worm is a self-replicating virus that does not alter files, but resides in active memory and duplicates itself. Worms use parts of an operating system that are automatic and usually invisible to the user. It is common for Worms to be noticed only when their uncontrolled replication uses up system resources, thus slowing or halting other tasks. Worms are most commonly spread by e-mail attachments and exploiting software vulnerabilities, such as buffer overflows. Although not all Worms perform destructive or malicious tasks, their presence can tie up or shut down networks due to the traffic generated by their spread. Some of the more notorious Worms have caused worldwide slowdowns of Internet traffic. In addition to replicating itself, a Worm may be programmed to perform any number of tasks after it has infected a user's computer. It can delete files on a host system, encrypt files in a cryptoviral extortion attack, or send documents via e-mail. Newer Worms can perform multiple functions and carry other executables as a payload. Worms can also seize control of a computer from a remote location via zombies, bots rootkits and back doors. The insertion point of a Worm refers to the specific location on the user's computer in which the Worm is installed. It is from the insertion point that it executes the malicious functions. Most Worms attempt to write new values to the run keys in the Windows Registry. This strategy ensures that the code will run when the user next logs on. In addition to the Windows registry, Worms often attempt to overwrite the configuration of other keys. For example, users having Worm-infected machines are sometimes unable to navigate to update sites for their anti-virus or other security software because their host files have been compromised. |