A worm spreads in a system by various mechanisms. File infection can also be considered a worm-like behavior.

A worm can spread in several ways:

• A worm can spread to other computers on the network by brute forcing default usernames and passwords of network shares or other machines.
• A worm can spread by exploiting the vulnerability in network protocols.
• A worm can spread using pen drives. When an autorun worm is executed, it looks for a pen drive attached to a system. The worm creates a copy of itself in the pen drive and also adds an autorun.inf file to the pen drive. When an infected pen drive is inserted into a new machine, autorun.inf is executed by Windows, which in turn executes the copied .exe. The copied exe is can now copy itself at different locations in the new machine where the pen drive is inserted.