Printable View
The RIAA is a clandestine organisation devoted to the termination with extreme prejudice of music downloaders.
They are totally merciless and will stop at nothing, even the persecution of 12 year old girls.
If you do not believe me, please take a look at their local "station master" (chief field operative) practicing reading out your death sentence :eek:
*COUGH*Quote:
Doesn't look like a virus to me in the sense that it doesn't make copies of itself without user intervention.
That is the definition of a virus:-
A piece of malicious software that requires user intervention to propgate. :eek:
That's where some people draw the line between viruses and worms - a virus needs user intervention, a worm does not. Other people argue that the difference is a virus attaches to other files, and a worm exists on its own. Other people say that while both worms and viruses make copies of themselves, only worms actually do anything to prpagate themselves, such as using email or remote exploits.
I disagree. A worm is designed for a specific purpose; a virus is simply designed to do as much damage as possible.
One does not "install" a virus in the same sense that one "installs" a trojan. To require user intervention to propagate, a virus in most cases would have to disguise itself as something else. Therefore it would be a trojan.
Calling it a virus gives people the impression that there's nothing they can do to avoid being attacked by it, when in fact they only need to refrain from downloading it.
But it's all just semantics anyway. They're all bad, and we all know the basic principles behind how they operate. There's about as many definitions for viruses and worms as there are for hackers and crackers (lets not get into that one).
Oh.. I don't know about that. IIRC, Sasser was designed to inflict damage (rumored as an attempt to drive more customers to the worm writer's mother's PC repair shop). In my opinion the differences are similar to what Tiger has put forward.Quote:
A worm is designed for a specific purpose; a virus is simply designed to do as much damage as possible.
Worms: propogation is self-initiated. The worm usually attempts to find other machines -- based on a code pattern -- that are also vulnerable (hence, why many firewalls go somewhat nuts during larger outbreaks).
Virus: propogation usually requires some user intervention (e.g., click here, run a macro, etc.) in the traditional sense. (remember that viruses can have a variety of vectors: MBR, macro, memory, etc.)
Trojan: a program bound to another program. Usually the other program is benign (e.g., Whack-a-Gopher) and is designed to encourage the user to play. Additionally, many trojans are of a client/server concept. Client is run by the "bad guy" while the server runs on the "victim".
Perhaps I'm more traditionalist in my definitions.
STFU! I AM NEVER WRONG! ME ME ME ME ME!
This seems more to be an argument over what actually constitutes "user intervention" than the difference between worms and viruses.
Granted, a virus does require *some* kind of user action. But these actions are not above and beyond what a user would normally do and fall within the description of normal activity. A virus will replicate itself when a user loads some program or another according to instructions contained within it. A trojan, on the other hand, actually requires the user him / herslef to make that copy. It has no instructions to make copies of itself.
Looking at a few of the more common baddies, your definitions appear to be more correct than mine. My point was this though: A virus will copy itself without the user knowing that a copy of anything has been made. A trojan (or its host program) must be copied intentionally.
A worm, however, definitely requires no user action of any kind.
I AM NEVER WRONG!
err... maybe this *one* time...
This I don't know about. Recently, there has been spyware that has trojans in them (mostly keylogger types but they are trojans nonetheless). I'm quite sure that many individuals do not intentionally infect themselves with spyware (unless they are me! :D). That said, it almost makes the spyware/trojan combination a form of a virus (user intervention required).Quote:
A trojan (or its host program) must be copied intentionally.
Well I would say it was a classic trojan............it is a program that purports to do one thing and actually does something (unwanted) else. This one pretends to be cracking software, but isn't?
A virus, by definition, has to infect. This could be by attachment or injection into a file or entering the boot sector. Infection, just like a biological virus.
A trojan requires human intervention............remember they had to take the horse into Troy?
The only distinction that a virus has is that it MUST infect.
So it is possible to have viral worms. These would not require human intervention.
At least those are the classic definitions ;)
And a virus does not have to do any damege, many do not have a payload. I distinctly remember the old days when there was some sort of competition as to who could make the smallest virus.....they didn't have room for a payload :D
Also "proof of concept" viruses generally don't have payloads, for example the Microsoft Word POC macro virus.
:)
EDIT: MsM, a trojan does require human intervention..............just like it says in Homer's Illyad.
What you might be confusing is the payload............a keylogger is a payload?
Or the ones which were "annoyances" like Ambulance (little ambulance goes across the screen at random times) or Jester (pops up to tell a joke).Quote:
I distinctly remember the old days when there was some sort of competition as to who could make the smallest virus
True. But spyware finds its way onto a system by masquerading as something else (i.e. CoolWebSearch). I am not implying that the user must first be aware of the fact that they are installing a trojan. Spyware in this manner does not continue to infect more files on the system once its payload has been delivered either. To infect another computer, it must again be downloaded from a fileserver somewhere and installed on another system. A server/client infection technique, where a virus uses a peer to peer method.Quote:
This I don't know about. Recently, there has been spyware that has trojans in them
I guess in this sense, a trojan is designed for a purpose (market research or key logging, in your example), whereas a virus simply inflicts damage. A trojan is usually constructed to operate symbiotically with its host program, while a virus can infect any number of programs.
But now the definition af a virus begins to blur again. Say it's running in memory, and infecting all outgoing emails. In one sense it needs the user to create those emails, but in another sense it is independently searching for those emails.
I guess we could say that a worm replicates and propagates independently, but a virus merely replicates. A trojan does neither. I think those are good definitions as far as infection methods are concerned.
What about payload then?
A trojan is designed for a purpose, as stated above. A virus, perhaps, causes some kind of damage to the host system, whereas a worm simply replicates itself; the damage is indirectly caused by the bandwidth spikes.
I always cosidered malware a worm when it was designed for something like passwrod sniffing or network mapping, whereas a virus might simply delete random files.
I agree with Nihil about this one, though. Definitely a trojan in that it appears to be one thing and is in fact something else.
[edit]
My favorite virus was the Cookie Monster virus. You had to give him an oreo before he would go away.
[/edit]
These are called Blended Threats insofar as the _payload_ can be any number of things. What differentiates viruses and worms is the trigger mechanism. A virus requires a user to click on an attachment, link or whatever in order to trigger the malicious code. A worm automatically propogates by locating computers running the service(s) that are vulnerable to it's built in exploit(s) and infecting them without the use of a human, (it's trigger is the successful infection of the new host).Quote:
Recently, there has been spyware that has trojans in them
Once the virus or worm is "on target" what results is called the payload. The payload in the case of the "classic" virus is the generation of new email to all the email addresses it can harvest from the new victim which contain a new copy of itself. The payload in the case of the "classic" worm is the code required to locate and infect he next victim down the line.
There has been a trend over the last few years to add "goodies" to the payload portion of both worms and viruses so that their "functionality" is "enhanced" hence the label Blended Threat.
Trojans are a different beast altogether. As in ancient history the Trojan Horse was something it did not appear to be... It appeared to be a gift/memorial to the failed seige. It turned out to be an attack mechanism, (for the uninformed - warriors were hidden inside and attacked after dark, opening the gates to the city to let the rest of the army to enter). This is what a Trojan is in computer terms - a piece of malicious code that purports to be something good, (a cool utility, game or whatever), while what it really is intended to do is to breach the security of the host computer. Typically, the "classic" Trojan opened a port and listened on it giving the attacker remote access to the infected computer.
The problem is that Trojans have become so synonymous with Remote Access that anything that grants remote access is now called a Trojan. This is wrong!!!! A worm that carries, as part of it's payload, a remote access "device" still is not a Trojan, it's a worm with multiple payloads, (a Blended Threat).
It's very important that we use the correct terminlogy when discussing these different entities or all we end up doing is confusing both ourselves and the other readers.
Not picking on Ms. M. - I just see so much of this mis-naming/identifying of these threats that I finally got fed up.... ;)