Virus vs Worm: Difference, Spread and Legal Treatment

Viruses and worms are the two self-replicating species of malware, and the whole comparison sits in two axes: the virus is parasitic, needing a host file and a human act to run, while the worm is standalone, a complete programme that spreads itself across networks with no one touching anything. The law treats them identically, both fall within s.43's definitions, so the marks lie in the mechanism. Topic 104 separated genus from species; this note, as asked, completes the pair.

1. The Comparison

Parasite against free agent

Figure 1: Parasite against free agent

Host against standalone. The virus exists inside something else, a document, an executable, a boot sector, and travels only as its host travels, mail attachments, copied drives, shared files; the worm is a complete programme needing no host at all, carrying its own machinery for finding and infecting the next machine.
Trigger against autonomy. The virus waits for the human act, opening the file, running the programme, enabling the macro, its statutory echo being operation when a programme, data or instruction is executed or another event occurs; the worm needs no human act after release: it scans for reachable systems, exploits a vulnerability or weak credential, copies itself across, and begins scanning again from the new host.
Speed and damage. Host-bound spread is slow and social; autonomous spread is exponential and technical, which is why the historic mass outbreaks and modern ransomware epidemics are worm-borne. The virus's damage typically lies in its payload; the worm damages by propagation itself, saturated networks and crashed servers, before any payload fires.
Defence emphasis. Against viruses: hygiene at the human trigger, attachments, macros, downloads, and endpoint scanning; against worms: patching and network discipline, closed ports, segmentation, updated systems, since no user restraint stops code that spreads without users.

Two paths of spread

Figure 2: Two paths of spread

2. The Legal Treatment

One statutory home. The s.43 Explanation's computer virus definition expressly captures the viral mechanism, attachment and operation on execution or another event, while its first limb, code that destroys, damages, degrades or adversely affects performance, and the computer contaminant definition's usurpation of normal operation comfortably cover the worm; the Act thus catches both without ever using the word worm (Topic 104)
The consequences. Releasing either is s.43(c), compensation without proof of intent; done dishonestly or fraudulently it is s.66, three years, cognizable and bailable; a worm or virus striking protected systems or essential services escalates through s.70 and s.66F, and the incident is CERT-In reportable on the six-hour clock (Topics 53, 58, 63, 64)
In the courtroom. The distinction surfaces in proof rather than charge: a virus case traces the infected host and the human chain that shared it, a worm case traces the vulnerability exploited and the propagation logs, the s.79A examination reconstructing either mechanism for the court (Topic 82)

⚠ Exam trap

Put the two axes first, host against standalone, human trigger against automatic propagation, and let everything else follow from them: speed, the worm's propagation damage, and the different defensive emphasis. On the law, say precisely that the statute defines computer virus and computer contaminant but never the worm, which falls within both definitions' harm and usurpation limbs, so the charge sheet, s.43(c) with s.66, is identical for both, and the difference lives in the forensic story, shared hosts for the virus, exploited vulnerabilities and propagation logs for the worm.

3. Frequently Asked Questions

What is the difference between a virus and a worm?

A virus is parasitic code: it attaches itself to a host file or programme, runs only when that host is executed or another triggering event occurs, and spreads as infected hosts are shared, so a human act drives every hop. A worm is a standalone programme: it needs no host and no user, scanning networks, exploiting vulnerabilities and copying itself from machine to machine automatically, which makes its spread exponential and its congestion itself a form of damage. The virus's harm usually lies in its payload; the worm's begins with propagation.

How does the law treat viruses and worms?

Identically. The Explanation to Section 43 defines computer virus, covering the attachment-and-trigger mechanism and any code that damages or degrades performance, and computer contaminant, covering instructions that usurp the normal operation of a computer resource, and a worm falls within these limbs though the Act never names it. Introducing either is a Section 43(c) contravention answering in compensation, becomes the Section 66 offence when dishonest or fraudulent, escalates through Sections 70 and 66F where protected systems or essential services are struck, and must be reported to CERT-In within six hours.

4. Related Topics

Topic 104: Malware vs Virus. The genus-species comparison this note completes.
Topic 53: Section 43. The definitions and the contravention.