A worm is malware that copies itself to other systems and spreads without waiting for a person to install a disguised program.
That self copying is the difference from a Trojan horse, which needs someone to open the disguise.
How it works
The worm moves from host to host and can clog a network even before it carries a second harmful action.
WannaCry showed the pattern in May 2017 when copies encrypted files on machines that lacked an available update.
Segmentation and prompt updates limit how far a copy can travel.
Offline backups remain the recovery path if encryption is the payload the worm brings, and this page gives no steps to build one.
Concrete examples
- Copies fill a corporate network over a weekend without a new installer on each desk.
- Hosts that cannot accept the copy stay unaffected.
- A boundary between network segments stops the spread even though one segment is hit.
Protective measures
- Install security updates and remove services that do not need to be reachable.
- Segment networks so a single infected host is not a path to every system.
- Limit file sharing between machines that have no business need for it.
- Keep backups offline so a spreading encryption event is not your only copy of the data.