Malware is almost as numerous as the stars, and depending on its type, it can affect your computer differently. To better understand how to keep your data secure and your Mac safe, you should know how it works. In this article, we’ll look at one of the most common types of malware… the WORM!
What is a worm virus?
A worm is a specific type of malware that can replicate itself, moving from computer to computer without any intervention from the users. It doesn’t need to hook into a separate piece of software to cause problems.
Worms can infect your computer in several ways. Some exploit security flaws in software, allowing the worm to attack your device when you visit an infected website or open a file. They can also be transmitted by a spam email or message in an app like Messages or Facebook Messenger. That email or message then contains a link. If you click that link, it will take you to a website that automatically downloads the worm.
Once your computer is infected, the hacker can steal data, destroy or encrypt files, and control your computer by locking you out.
How does worm malware spread?
Worm doesn’t require a host system or user action to spread. It means it’s self-replicating but doesn't attach to a file or program. Instead, it moves through networks, from one computer to another, exploiting vulnerabilities in the network. File sharing, social networks, Instant messengers (IMs), external devices, etc., are well-known platforms for worm attacks.
What’s more, worms are more agile than viruses and can roll out more quickly. They can also seriously disrupt large networks, causing them to slow down by consuming vast bandwidth.
How can a computer worm harm your Mac?
For those of you who still think a worm is not that big of a deal, here’s the list of 6 WHYS you don’t want it on your computer, ever!
- It steals your data!
- It sneaks in other malware!
- It secretly deletes your files!
- It causes network overload!
- It uses up your bandwidth!
- It eats up space on your hard drive!
What is the difference between a virus and a worm?
Are viruses and worms the same thing? Absolutely not! The critical difference between virus and worm malware is this: viruses are activated by us humans. They won’t do your Mac any harm unless you authorize them to. And worms… well, you already know.
Though when it comes to virus vs. worm, they’re both pretty bad!
Are there any well-known examples of worms?
Several. One of the most infamous is Stuxnet — a worm developed as a joint effort by the US and Israel to target Iran’s attempts to build a nuclear weapon.
It was discovered in 2010 and was spread using a USB thumb drive. It’s believed that it targeted software controlling Iran's uranium facility. According to the New York Times, among the damage it caused was the self-destruction of 1,000 centrifuges. A programming error allowed it to escape to the wider internet, where security researchers discovered it.
Koobface
Perhaps the most infamous worm of all, Koobface was one of the first malware programs to exploit the possibilities offered by social media. In 2008, social media was still in its infancy, and Facebook was relatively new. The Koobface worm infected user accounts and spread them by sending fake messages to users' friends. Those messages claimed that Flash Player on the recipient's computer was outdated and — who would doubt — contained a link to download the updater. When the user clicked the link, a computer got infected.
WannaCry
In 2017, WannaCry caused hundreds of millions of dollars of damage to computer networks worldwide. It combined the techniques of a worm by exploiting a vulnerability in Microsoft's SMB Version 1 file-sharing protocol, known as Eternal Blue. Any network that hadn't patched SMB Version 1 was at risk, including systems belonging to some of the largest organizations in the world.
Storm Worm
In 2006, an email with the subject line '230 dead as storm batters Europe' was unleashed. Given that such a catastrophic event is almost unheard of in Europe, many people clicked the link it contained to read more. That link inevitably unleashed malware that infected the user's computer and turned it into a bot to continue spreading the worm by itself, sending spam email messages.
An example of a Mac Mail worm discovered in 2021
Early in 2021, security researcher Mikko Kenttälä discovered a surprising Mac vulnerability within Apple's Mail app. What makes this particular worm troublesome is it requires zero clicks. It works like this:
The attacker mails a user a ZIP archive that Mail automatically unpacks under certain conditions. When unpacked, a virus file will do whatever it pleases on your computer.
How do I know if my computer has a worm?
If you have a worm in your computer, you won’t know about it at first, as they don’t knock and introduce themselves. But if you know what the macOS worm virus symptoms are, you can find it and remove all traces of it.
The signs of a worm computer virus include the following:
- Your operating system will start to greatly slow down for no apparent reason, due to your CPU and memory being overtaxed.
- Your MacBook and/or browser will eventually crash, forcing a reboot.
- Due to your device slowing down, your computer’s fan will fire up for no reason, and the battery will start to overheat.
- Your files go missing or get locked. They may also be corrupted.
- Your Wi-Fi becomes unstable and eventually crashes due to the sheer volume of data being stolen and transmitted. This will also cause your firewall to go into overdrive.
- You’ll see unknown apps appearing with garbled names and blurry icons.
- There will be changes to your system files, including rogue configuration profiles and startup items. Worms can also hide inside legitimate-looking files to escape detection.
- Your antivirus software may stop working.
- Updates for macOS and installed apps will be unable to be installed.
- Worms like to mutate and spread. Therefore, your friends and contacts may get strange emails or chat messages trying to trick them into clicking a link.
How to check if your Mac has been infected with a worm
The last section is your guide to diagnosing a severe case of network worms on your MacBook. But now, you need to be absolutely sure of what you’ve got.
First, run an online virus scan. The best tool for the job is CleanMyMac, powered by Moonlock Engine. We’ll be diving deeper into how to use CleanMyMac in the next section.
Next, worm malware is highly communicative, so you need to monitor your network activity. Open Terminal and type:
Nettop
This will then give you a list of what apps are talking. If you see any you don’t recognize, it could be a symptom of an internet worm.
Next, type the following into Terminal:
lsof -i
This will show you all of your open internet connections. Again, any unrecognized ones could be worms and need to be checked out further.
The next step to detect worms on a Mac is to run a system diagnostic. On Terminal, type:
Sudo sysdiagnose
It will take a few minutes for the report to be generated. It will be downloaded to your computer as a zip file. Unless you’re an IT professional, you likely won’t be able to understand the large number of files generated, so an expert’s advice might be needed.
However, in a vast number of cases, using CleanMyMac will solve the whole problem for you. In the next section, we’ll go into how to use it.
How to get rid of a worm virus on Mac
Getting rid of a worm on a Mac can be quickly achieved by using a specialized tool. It’s faster, and there’s a greater guarantee that all traces of it will be caught and destroyed the first time around.
Like we’ve said, the best tool for this, by far, is CleanMyMac, powered by Moonlock Engine. It’s mostly designed as a Mac configuration tool, but one of its secret weapons is a malware detection program that is ruthlessly efficient at what it does. If a worm is hiding on your device, it will be found.
To begin to remove the worm virus on your Mac, sign up for a free trial of CleanMyMac and install the platform. Then do the following to bid farewell to the worm:
- After opening CleanMyMac, click Protection on the left.
- Click Configure Scan to select your scan settings. Unless you have any particular reason not to, enable every option, save, and exit.
- Now click the Scan button to send CleanMyMac off to work. It will begin scouring the depths of your MacBook, looking for all traces of the worm.
- When the worm has been found, CleanMyMac will show you all the infected files. Select them all and click Remove.
- Exit Protection and select Cleanup on the left-hand side. This will detect and remove all unneeded junk files clogging up your Mac’s hard drive. Some of them will likely be connected to the worm, so it’s best not to skip this step.
How to manually remove a worm virus from your Mac
You can also stop a worm attack manually. However, we must stress that manual removal is a very hit-and-miss affair, and you’re not guaranteed to get it all.
However, if you’re determined to do the worm virus Mac removal yourself, here are the areas you need to focus on.
Disconnect from your Wi-Fi
This is extremely important. Malware, including worms, relies on a constant internet connection to exfiltrate files and data. Cutting that line severely hobbles their ability to do their job.
Look for suspicious running processes
Worms will likely be taking over your Activity Monitor and eating up your CPU. Note the processes doing this. Run a web search for the names to determine whether they are legitimate processes. If not, shut them down.
Check the Launch Agents and Launch Daemons files
A worm getting into these folders ensures that it always starts up with your Mac. They also use these folders to hide from prying eyes.
Go to:
~/Library/LaunchAgents
/Library/LaunchAgents
/Library/LaunchDaemons
Look through the entries to see if anything suspicious jumps out at you. This includes weird-looking names, especially plist files with random characters. If you see any, open them with TextEdit to see what they do. Delete the ones that are clearly suspicious.
Delete any unknown or suspicious apps in Applications
Go to the Applications folder in Finder and see if any suspicious-looking apps have been installed behind your back. If you find any, delete them and empty the trash bin.
Delete any unknown apps in Login Items
Go to System Settings > General > Login Items. If you see any unfamiliar apps there, delete them and make sure the corresponding app in your Applications folder is also gone.
Check for rogue configuration profiles
The final system setting to check is the configuration profile section.
Go to System Settings > Privacy & Security > Profiles. If you see any configuration profiles there that you didn’t create, delete them immediately.
How to avoid getting worm malware?
There’s no way to guarantee your Mac will never be infected. Every computer connected to the internet or using external media shared with other computers is potentially at risk. However, there are several steps you can take to protect yourself.
#1. Keep your operating system and applications up to date.
Worms often exploit flaws in software to replicate themselves or spread. As soon as a worm is discovered doing this, the developer should start working on an update to fix the flaw. This will usually be available within a few days of discovery. So, by keeping your OS and applications up to date, you’re ensuring that you have the best protection against worms.
#2. Don’t click on links in emails or instant messages.
Spam messages, whether sent by email or messaging platform, are common to spread malware, worms included. They will contain a link with text that encourages you to click on it. If the malware is sent by instant message, it may tell you that it’s a video you must watch and may appear to have come from a friend. To protect yourself, don’t ever click on a link in an email or other message unless you’re certain of its origin.
#3. Be careful about what websites you visit.
Websites that offer free content that would otherwise have to be paid for, such as streaming the latest movies or distributing license codes for software, are often used to spread malware. By visiting those sites, you put your computer at risk, so they are best avoided.
Worms are a form of malware that replicate and spread quickly, often exploiting flaws in software. But you can protect yourself from them to an extent. And even if your computer is infected, you can do a great deal to get rid of the worm and restore your computer back to health.
