What is the difference between a worm and a trojan ?

Ok, I know the difference between a virus and a trojan. But what is the difference between a worm
and a trojan? Is the one a subset of the other type or are they completele different ?

Peter

Bit
Tue May 18 19:10:45 CDT 2004

On Wed, 19 May 2004 01:31:55 +0200, Peter Meister wrote:
> Ok, I know the difference between a virus and a trojan. But what is
> the difference between a worm and a trojan? Is the one a subset of
> the other type or are they completele different ?

A worm could install a trojan.

A trojan is malware which allows crackers into your system through a backdoor.
A worm is malware which infectects your system and spreads by it's self.
It may carry a trojan as a payload.

Phil
Tue May 18 19:28:04 CDT 2004

A virus for computer systems changes the way part of a program or operating
system operates by taking advantage of security flaws. A virus does not
necessarily spread from an infected system to other systems.

A 'worm' is a virus that spreads itself by using the systems it infects
to spread to other machines through the Internet or through other networks.
The 'Swen' worm is a good example; it harvests email addresses from Usenet
newsgroups and from storage on infected systems, then emails infectious
messages to those harvested addresses. Sasser is also a worm.

A trojan has the specific purpose of allowing outside access to a computer
system; the infected system can be controlled by a remote system, and data
can be transfer to the remote system as well. A trojan can be spread by a
virus.

Spyware collects data from the system it compromises and communicates that
data to a remote source; it isn't a virus because it doesn't really
'infect' the system, but is installed as a program (or a cookie) without the
explicit consent of the system owner.

On the other hand, there are a million stories in the internet, and nearly
as many definitions.

--
Phil Weldon, pweldonatmindjumpdotcom
For communication,
replace "at" with the 'at sign'
replace "mindjump" with "mindspring."
replace "dot" with "."

"Peter Meister" <pmeister2@lycos.com> wrote in message
news:c8e6db$2u5$00$1@news.t-online.com...
> Ok, I know the difference between a virus and a trojan. But what is the
difference between a worm
> and a trojan? Is the one a subset of the other type or are they completele
different ?
>
> Peter
>

Ben
Tue May 18 19:26:50 CDT 2004

On 18 May 2004 13:31, Peter Meister wrote:
>Ok, I know the difference between a virus and a trojan. But what is
>the difference between a worm and a trojan? Is the one a subset of the
>other type or are they completele different ?
>
>Peter

A worm is a self-replicating piece of code that doesn't require the user
to take action in order to activate it. It infects a machine, then goes
looking for other machines to infect, all the while unattended and most
likely unnoticed by the user. Worms are typically self-contained; i.e.
they don't infect other files.
A trojan is a program that appears to be something it's not; typically
something interesting, amusing or beneficial. It can masquerade as a utility
("Click here to protect your computer against viruses!") or as something
else ("Click here to see Britny naked!").
--
-Ben-
Ben M. Schorr, MVP-OneNote
OneNote FAQ: http://home.hawaii.rr.com/schorr/Computers/OneNoteFAQ.htm
SchorrTech Blog: http://www.thespoke.net/MyBlog/bschorr/MyBlog.aspx

StarScripter
Tue May 18 19:34:29 CDT 2004

Peter Meister wrote:
| Ok, I know the difference between a virus and a trojan. But what is
| the difference between a worm and a trojan? Is the one a subset of
| the other type or are they completele different ?
|
| Peter

From the Microsoft Computer Dictionary:

worm n. A program that propagates itself across computers, usually by
creating copies of itself in each computer's memory. A worm might
duplicate itself in one computer so often that it causes the computer to
crash. Sometimes written in separate segments, a worm is introduced
surreptitiously into a host system either as a prank or with the intent
of damaging or destroying information. See also bacterium, Internet
Worm, Trojan horse, virus.


Trojan horse n. A destructive program disguised as a game, utility, or
application. When run, a Trojan horse does something harmful to the
computer system while appearing to do something useful. See also virus,
worm.


virus n. An intrusive program that infects computer files by inserting
in those files copies of itself. The copies are usually executed when
the file is loaded into memory, allowing the virus to infect still other
files, and so on. Viruses often have damaging side effects-sometimes
intentionally, sometimes not. For example, some viruses can destroy a
computer's hard disk or take up memory space that could otherwise be
used by programs. See also Good Times virus, Trojan horse, worm.


--
S.S.

null
Tue May 18 19:31:09 CDT 2004

On Wed, 19 May 2004 01:31:55 +0200, pmeister2@lycos.com (Peter
Meister) wrote:

>Ok, I know the difference between a virus and a trojan. But what is the difference between a worm
>and a trojan? Is the one a subset of the other type or are they completele different ?

Since both viruses and worms "spread", the question is usually "what's
the difference between a virus and a worm?" I found one non-technical
answer that may be sufficient to give you the basic idea:

http://www.bsu.edu/ucs/article/0,1370,6188-1940-4488,00.html


Art
http://www.epix.net/~artnpeg

kurt
Wed May 19 08:50:38 CDT 2004

Ben wrote:

> On 18 May 2004 13:31, Peter Meister wrote:
>
>>Ok, I know the difference between a virus and a trojan. But what is
>>the difference between a worm and a trojan? Is the one a subset of the
>>other type or are they completele different ?
>>
>>Peter
>
>
> A worm is a self-replicating piece of code

yes...

> that doesn't require the user
> to take action in order to activate it.

that part is debatable... if you add that criteria we're left with a
wide variety of self-replicating malware that has no classification...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

FromTheRafters
Wed May 19 20:08:22 CDT 2004


"Peter Meister" <pmeister2@lycos.com> wrote in message news:c8e6db$2u5$00$1@news.t-online.com...
> Ok, I know the difference between a virus and a trojan. But what is the difference between a worm
> and a trojan? Is the one a subset of the other type or are they completele different ?

All of these terms are *aspects* of certain malware programs.
Generally, trojans don't replicate. However, Phatbot trojan
has adopted worm function, and so becomes a worm as well
as whatever else it is. The terms only really become clear if
one talks about each in its purest form.

A trojan appears (for some reason) to be something desireable,
and yet has a function that is decidedly *not* desired. It may or
may not alspo supply the desired function.

Both worm and virus are self-replicating programs which may or
may not have any other function than replication. The difference
between worm and virus (IMO) is in the way that they replicate.

This has been discussed many many many times in a.c.v. where
I have been known to hang out. Not many agree with me, but
that's my story - and I'm stickin' to it.

FromTheRafters
Wed May 19 20:31:38 CDT 2004


<Ben M. Schorr>; "MVP-OneNote" <bens@bogusaddress.mvp> wrote in message news:4905df3b05484681b62000eeb2fef9d8@ghytred.com...
> On 18 May 2004 13:31, Peter Meister wrote:
> >Ok, I know the difference between a virus and a trojan. But what is
> >the difference between a worm and a trojan? Is the one a subset of the
> >other type or are they completele different ?
> >
> >Peter
>
> A worm is a self-replicating piece of code that doesn't require the user
> to take action in order to activate it.

Many worms require human interaction in order to function, in fact
most of the more common ones do. The most pure forms of worm
do infact do as you say, however it is not a defining factor.

> It infects a machine, then goes looking for other machines to infect,

Some definitions do indeed say this, but it is an inadequate definition
because some worms don't do *this* either.

> all the while unattended and most likely unnoticed by the user.

Superfluous, but not incorrect.

> Worms are typically self-contained; i.e. they don't infect other files.

Usually referred to as "does not *need* to infect programs", as opposed
to viruses which *do* need to infect programs.

(files are not the only things that can be considered programs)

> A trojan is a program that appears to be something it's not;

...or is something else in addition to what it appears to be.

data64
Wed May 19 20:53:47 CDT 2004

pmeister2@lycos.com (Peter Meister) wrote in news:c8e6db$2u5$00$1@news.t-
online.com:

> Ok, I know the difference between a virus and a trojan.

What is the difference between a virus and a worm ?

data64

kurt
Wed May 19 22:29:44 CDT 2004

data64 wrote:

> pmeister2@lycos.com (Peter Meister) wrote in news:c8e6db$2u5$00$1@news.t-
> online.com:
>
>
>>Ok, I know the difference between a virus and a trojan.
>
>
> What is the difference between a virus and a worm ?

both are self-replicating malware... a virus must be able to 'infect' a
host 'program' and a worm must be able to reproduce without infecting
a host program (where 'program' is understood to mean 'a sequence of
executable or interpretable instructions' and 'infect' is understood to
mean 'attach to a host in such a way that when an attempt is made to
execute the host the infector executes as well as or instead of the
host')...

of course these are not mutually exclusive, a worm that can also infect
or a virus that can also spread without infecting is allowed -
worm/virus hybrids are sometimes lumped into the blanket term 'blended
threat'...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

=?iso-8859-1?Q?Hippel=E4inen?=
Thu May 20 03:55:51 CDT 2004

kurt wismer wrote:
<...>
> of course these are not mutually exclusive, ...

That's one reason why the taxonomy of malware has lost its meaning. Many
of them try to do many things.

Once upon a time there were distinctions. The difference between a virus
and trojan was in motivation. Viruses try to spread as much as possible,
and often send information about their hosts to the attacker. Trojans
try to give control of the infected machine to the attacker.

The subdivision virus vs. worm was historic. First viruses had to store
themselves on floppies, because sneakernet was the only medium
available. When networked computers became common, it was enough to
infect a running application instance (worm). You could get rid of a
worm by turning power off.

But as mentioned, the differences don't count anymore.

-- Lassi

kurt
Thu May 20 09:58:04 CDT 2004

Lassi Hippeläinen wrote:

> kurt wismer wrote:
> <...>
>
>>of course these are not mutually exclusive, ...
>
>
> That's one reason why the taxonomy of malware has lost its meaning. Many
> of them try to do many things.
>
> Once upon a time there were distinctions. The difference between a virus
> and trojan was in motivation. Viruses try to spread as much as possible,
> and often send information about their hosts to the attacker. Trojans
> try to give control of the infected machine to the attacker.

i'm afraid you are mistaken...
a) you're apparently mistaking backdoor trojans for all trojans - not
all are intended to give remote access, that's a relatively new
capability...
b) virus infection creates a trojan out of the host program - it always
has done...

> The subdivision virus vs. worm was historic. First viruses had to store
> themselves on floppies, because sneakernet was the only medium
> available.

viruses didn't have to do any such thing... viruses infected programs,
they always did... those programs may be on the floppy disk or the user
may later move them on to a floppy disk... regardless, programs were
shared often enough that no special effort needed to be made to ensure
distribution between machines...

> When networked computers became common, it was enough to
> infect a running application instance (worm). You could get rid of a
> worm by turning power off.

that's an issue of how it's implemented, not how it's defined...

> But as mentioned, the differences don't count anymore.

respectfully, i think it may be that you were misunderstanding the
differences in the first place... it's not hard, there are no end of
computer jargon files out there that people think are authoritative but
are in fact woefully inadequate when they attempt to cover this field
with a few short lines... i've been following this field for the past
15 years and i can't think of a single instance of a major redefinition
of any of the principle concepts (virus, worm, or trojan) during that
time...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

=?iso-8859-1?Q?Hippel=E4inen?=
Thu May 20 11:25:49 CDT 2004

kurt wismer wrote:

> i'm afraid you are mistaken...

No, I was simplifying (maybe too far). I tried to show the architectural
differences in malware types. But as mentioned, they doesn't matter
anymore, because today the buggers can mix all of the features.

-- Lassi (who started with Teletypes and punched tape in 1972)

alun
Thu May 20 12:32:58 CDT 2004

In article <40AC7297.663853F6@welho.organized.invalid>, Lassi
=?iso-8859-1?Q?Hippel=E4inen?=
<lassi.hippelainen@welho.organized.invalid> wrote:
>Once upon a time there were distinctions. The difference between a virus
>and trojan was in motivation. Viruses try to spread as much as possible,
>and often send information about their hosts to the attacker. Trojans
>try to give control of the infected machine to the attacker.

In particular, a Trojan is generally targeted at the one person or machine
that gets the malware. Viruses and worms are meant to distribute
themselves. In its operation, a virus creates a trojan.

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]
--
Texas Imperial Software | Find us at http://www.wftpd.com or email
1602 Harvest Moon Place | alun@texis.com.
Cedar Park TX 78613-1419 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(512)258-9858 | Try our NEW client software, WFTPD Explorer.

unruh
Thu May 20 13:54:07 CDT 2004

alun@texis.invalid (Alun Jones [MS MVP - Security]) writes:

]In article <40AC7297.663853F6@welho.organized.invalid>, Lassi
]=?iso-8859-1?Q?Hippel=E4inen?=
] <lassi.hippelainen@welho.organized.invalid> wrote:
]>Once upon a time there were distinctions. The difference between a virus
]>and trojan was in motivation. Viruses try to spread as much as possible,
]>and often send information about their hosts to the attacker. Trojans
]>try to give control of the infected machine to the attacker.

]In particular, a Trojan is generally targeted at the one person or machine
]that gets the malware. Viruses and worms are meant to distribute
]themselves. In its operation, a virus creates a trojan.

?? Trojan-- From Trojan horse-- When the greek city troops could not
breach teh walls of Troy, they left with a gift to the Trojans to
propitiate them of a giant wooden horse. The Trojans pulled the horse
into the city. That night the greeks hidden in the horse came out,
opened the gates ofthe city and Troy was destroyed.

By analogy, an attractive programme which contains hidden within it a
piece of malware, so when the attractive program is run, the malware is
also run, breaching the security of the machine. It is something which
requires the action of accepting and running the attractive offering to
bring up the malware. Many email "viruses" propagate via trojans.

A worm is something which finds a soft entry and tunnels into a machine.
Ie, it propagates via hidden defects in the software of the system.
The old Morris sendmail would I think be a worm.

Ie, worms and trojans refer to the method of propagation. A virus could
propagate by means of a trojan. A virus could replicate by means of
trojans.

(It is a shame that the people who got destroyed by the hidden men
should in addition have their name sullied by being attached to the means of destruction.
The horse should really have been called Ulysses's Horse, since it was
his idea, he being a wiley artifacer, and the means of propagation should be
called a Ulysses. )

MisterKurtz
Thu May 20 14:48:53 CDT 2004

"Bill Unruh" <unruh@string.physics.ubc.ca> wrote in message
news:c8iusf$f68$1@string.physics.ubc.ca...
> alun@texis.invalid (Alun Jones [MS MVP - Security]) writes:
>
> ]In article <40AC7297.663853F6@welho.organized.invalid>, Lassi
> ]=?iso-8859-1?Q?Hippel=E4inen?=
> ] <lassi.hippelainen@welho.organized.invalid> wrote:
> ]>Once upon a time there were distinctions. The difference between a virus
> ]>and trojan was in motivation. Viruses try to spread as much as possible,
> ]>and often send information about their hosts to the attacker. Trojans
> ]>try to give control of the infected machine to the attacker.
>
> ]In particular, a Trojan is generally targeted at the one person or
machine
> ]that gets the malware. Viruses and worms are meant to distribute
> ]themselves. In its operation, a virus creates a trojan.
>
> ?? Trojan-- From Trojan horse-- When the greek city troops could not
> breach teh walls of Troy, they left with a gift to the Trojans to
> propitiate them of a giant wooden horse. The Trojans pulled the horse
> into the city. That night the greeks hidden in the horse came out,
> opened the gates ofthe city and Troy was destroyed.
>
> By analogy, an attractive programme which contains hidden within it a
> piece of malware, so when the attractive program is run, the malware is
> also run, breaching the security of the machine. It is something which
> requires the action of accepting and running the attractive offering to
> bring up the malware. Many email "viruses" propagate via trojans.
>
> A worm is something which finds a soft entry and tunnels into a machine.
> Ie, it propagates via hidden defects in the software of the system.
> The old Morris sendmail would I think be a worm.
>
> Ie, worms and trojans refer to the method of propagation. A virus could
> propagate by means of a trojan. A virus could replicate by means of
> trojans.
>
> (It is a shame that the people who got destroyed by the hidden men
> should in addition have their name sullied by being attached to the means
of destruction.
> The horse should really have been called Ulysses's Horse, since it was
> his idea, he being a wiley artifacer, and the means of propagation should
be
> called a Ulysses. )


So where do the condoms come in?


Kurtz

Phil
Thu May 20 18:33:55 CDT 2004

Insult to injury?

--
Phil Weldon, pweldonatmindjumpdotcom
For communication,
replace "at" with the 'at sign'
replace "mindjump" with "mindspring."
replace "dot" with "."


"MisterKurtz" <Kurtz@lCentralStation> wrote in message
news:u7T$yNqPEHA.1128@TK2MSFTNGP12.phx.gbl...
> "Bill Unruh" <unruh@string.physics.ubc.ca> wrote in message
> news:c8iusf$f68$1@string.physics.ubc.ca...
> > alun@texis.invalid (Alun Jones [MS MVP - Security]) writes:
> >
> > ]In article <40AC7297.663853F6@welho.organized.invalid>, Lassi
> > ]=?iso-8859-1?Q?Hippel=E4inen?=
> > ] <lassi.hippelainen@welho.organized.invalid> wrote:
> > ]>Once upon a time there were distinctions. The difference between a
virus
> > ]>and trojan was in motivation. Viruses try to spread as much as
possible,
> > ]>and often send information about their hosts to the attacker. Trojans
> > ]>try to give control of the infected machine to the attacker.
> >
> > ]In particular, a Trojan is generally targeted at the one person or
> machine
> > ]that gets the malware. Viruses and worms are meant to distribute
> > ]themselves. In its operation, a virus creates a trojan.
> >
> > ?? Trojan-- From Trojan horse-- When the greek city troops could not
> > breach teh walls of Troy, they left with a gift to the Trojans to
> > propitiate them of a giant wooden horse. The Trojans pulled the horse
> > into the city. That night the greeks hidden in the horse came out,
> > opened the gates ofthe city and Troy was destroyed.
> >
> > By analogy, an attractive programme which contains hidden within it a
> > piece of malware, so when the attractive program is run, the malware is
> > also run, breaching the security of the machine. It is something which
> > requires the action of accepting and running the attractive offering to
> > bring up the malware. Many email "viruses" propagate via trojans.
> >
> > A worm is something which finds a soft entry and tunnels into a machine.
> > Ie, it propagates via hidden defects in the software of the system.
> > The old Morris sendmail would I think be a worm.
> >
> > Ie, worms and trojans refer to the method of propagation. A virus could
> > propagate by means of a trojan. A virus could replicate by means of
> > trojans.
> >
> > (It is a shame that the people who got destroyed by the hidden men
> > should in addition have their name sullied by being attached to the
means
> of destruction.
> > The horse should really have been called Ulysses's Horse, since it was
> > his idea, he being a wiley artifacer, and the means of propagation
should
> be
> > called a Ulysses. )
>
>
> So where do the condoms come in?
>
>
> Kurtz
>
>

kurt
Fri May 21 09:34:52 CDT 2004

Lassi Hippeläinen wrote:

> kurt wismer wrote:
>
>
>>i'm afraid you are mistaken...
>
>
> No, I was simplifying (maybe too far). I tried to show the architectural
> differences in malware types. But as mentioned, they doesn't matter
> anymore, because today the buggers can mix all of the features.

they always good mix all the features - why they didn't start doing so
much earlier, i have no idea...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

kurt
Fri May 21 10:47:04 CDT 2004

kurt wismer wrote:
[snip]
> they always good mix all the features - why they didn't start doing so

oh, that's embarrassing... should be "they always could mix all the
features"... i have no idea how "good" got in there...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

Mark
Sun May 23 21:45:05 CDT 2004

"Bill Unruh" <unruh@string.physics.ubc.ca> wrote in message
news:c8iusf$f68$1@string.physics.ubc.ca...
> alun@texis.invalid (Alun Jones [MS MVP - Security]) writes:
>
> ]In article <40AC7297.663853F6@welho.organized.invalid>, Lassi
> ]=?iso-8859-1?Q?Hippel=E4inen?=
> ] <lassi.hippelainen@welho.organized.invalid> wrote:
> ]>Once upon a time there were distinctions. The difference between a virus
> ]>and trojan was in motivation. Viruses try to spread as much as possible,
> ]>and often send information about their hosts to the attacker. Trojans
> ]>try to give control of the infected machine to the attacker.
>
> ]In particular, a Trojan is generally targeted at the one person or
machine
> ]that gets the malware. Viruses and worms are meant to distribute
> ]themselves. In its operation, a virus creates a trojan.
>
> ?? Trojan-- From Trojan horse-- When the greek city troops could not
> breach teh walls of Troy, they left with a gift to the Trojans to
> propitiate them of a giant wooden horse. The Trojans pulled the horse
> into the city. That night the greeks hidden in the horse came out,
> opened the gates ofthe city and Troy was destroyed.
>
> By analogy, an attractive programme which contains hidden within it a
> piece of malware, so when the attractive program is run, the malware is
> also run, breaching the security of the machine. It is something which
> requires the action of accepting and running the attractive offering to
> bring up the malware. Many email "viruses" propagate via trojans.
>
> A worm is something which finds a soft entry and tunnels into a machine.
> Ie, it propagates via hidden defects in the software of the system.
> The old Morris sendmail would I think be a worm.
>
> Ie, worms and trojans refer to the method of propagation. A virus could
> propagate by means of a trojan. A virus could replicate by means of
> trojans.
>
> (It is a shame that the people who got destroyed by the hidden men
> should in addition have their name sullied by being attached to the means
of destruction.
> The horse should really have been called Ulysses's Horse, since it was
> his idea, he being a wiley artifacer, and the means of propagation should
be
> called a Ulysses. )

Ah, but the Trojans didn't write the book...

Anyway, Trojan probably means "related to Troy": it the horse they used at
Troy, not a Trojan-horse. The supposed inventor was (as you pointed out)
notoriously cunning, so his name was so often as an insult that the more
specific meaning probably wouldn't have stuck .

And writing Odysseus (Latin Ulysses) would just confuse everybody - we all
know how much difficulty there is between virii and viruses...

BTW, is cross-posting generally between these newsgroups generally accepted?

Mark

Norman
Sun May 23 22:45:41 CDT 2004


On Thu, 20 May 2004, Bill Unruh wrote:
[snip]
> ?? Trojan-- From Trojan horse-- When the greek city troops could not
> breach teh walls of Troy, they left with a gift to the Trojans to
> propitiate them of a giant wooden horse. The Trojans pulled the horse
> into the city. That night the greeks hidden in the horse came out,
> opened the gates ofthe city and Troy was destroyed.
>
> By analogy, an attractive programme which contains hidden within it a
> piece of malware, so when the attractive program is run, the malware is
> also run, breaching the security of the machine. It is something which
> requires the action of accepting and running the attractive offering to
> bring up the malware. Many email "viruses" propagate via trojans.
[snip]
> (It is a shame that the people who got destroyed by the hidden men
> should in addition have their name sullied by being attached to the means of destruction.
> The horse should really have been called Ulysses's Horse, since it was
> his idea, he being a wiley artifacer, and the means of propagation should be
> called a Ulysses. )

Possibilities:
1. The horse was named after the battle.
2. The horse was named after the city it was taken into.
3. The horse was named after the people that were suckered in.
4. Ulysses had better/worse PR (depending on your point of view).

Many have heard the story of what allegedly happened to the cities of
Sodom and Gomorrah, and most people have heard of "sodomy", a practice
named after the city of Sodom, but nobody that I know of has named any
practice after the city of Gomorrah. I think that's unfair[1]. :)

[1] Exactly *which* of the two cities it's unfair to is another matter.
--
Norman De Forest http://www.chebucto.ns.ca/~af380/Profile.html
af380@chebucto.ns.ca [=||=] (A Speech Friendly Site)
"One suspects that by now even *Nigerians* have Nigeria blacklisted ;)."
-- Jim Seymour on 419 scams, news.admin.net-abuse.email, Tue, Nov 19, 2002

Book
Mon May 24 21:29:34 CDT 2004

"Norman L. DeForest" wrote:

> On Thu, 20 May 2004, Bill Unruh wrote:
> [snip]
> > ?? Trojan-- From Trojan horse-- When the greek city troops could not
> > breach teh walls of Troy, they left with a gift to the Trojans to
> > propitiate them of a giant wooden horse. The Trojans pulled the horse
> > into the city. That night the greeks hidden in the horse came out,
> > opened the gates ofthe city and Troy was destroyed.
> >
> > By analogy, an attractive programme which contains hidden within it a
> > piece of malware, so when the attractive program is run, the malware is
> > also run, breaching the security of the machine. It is something which
> > requires the action of accepting and running the attractive offering to
> > bring up the malware. Many email "viruses" propagate via trojans.
> [snip]
> > (It is a shame that the people who got destroyed by the hidden men
> > should in addition have their name sullied by being attached to the means of destruction.
> > The horse should really have been called Ulysses's Horse, since it was
> > his idea, he being a wiley artifacer, and the means of propagation should be
> > called a Ulysses. )
>
> Possibilities:
> 1. The horse was named after the battle.
> 2. The horse was named after the city it was taken into.
> 3. The horse was named after the people that were suckered in.
> 4. Ulysses had better/worse PR (depending on your point of view).
>
> Many have heard the story of what allegedly happened to the cities of
> Sodom and Gomorrah, and most people have heard of "sodomy", a practice
> named after the city of Sodom, but nobody that I know of has named any
> practice after the city of Gomorrah. I think that's unfair[1]. :)
>
> [1] Exactly *which* of the two cities it's unfair to is another matter.

According to the Gay & Black Glossary (
http://mindprod.com/ggloss/gomorrahy.html ), "gomorrahy" is "the
Canadian legal term for fisting (both vaginal and anal insertion of a
hand), footing (both vaginal and anal), and stumping (both vaginal and
anal insertion of an amputated stump)." In other words, gomorrahy -
a.k.a. the Sin of Gomorrah - is extremity insertion (it being understood
that the penis is no more an extremity than it is a middle leg).

Book of Gomorrah

FromTheRafters
Tue May 25 22:23:46 CDT 2004


"Book of Gomorrah" <gomorrahize@yahoo.com> wrote in message news:40B2AFA8.5DAD1AF2@yahoo.com...
> "Norman L. DeForest" wrote:
>
> > On Thu, 20 May 2004, Bill Unruh wrote:
> > [snip]
> > > ?? Trojan-- From Trojan horse-- When the greek city troops could not
> > > breach teh walls of Troy, they left with a gift to the Trojans to
> > > propitiate them of a giant wooden horse. The Trojans pulled the horse
> > > into the city. That night the greeks hidden in the horse came out,
> > > opened the gates ofthe city and Troy was destroyed.
> > >
> > > By analogy, an attractive programme which contains hidden within it a
> > > piece of malware, so when the attractive program is run, the malware is
> > > also run, breaching the security of the machine. It is something which
> > > requires the action of accepting and running the attractive offering to
> > > bring up the malware. Many email "viruses" propagate via trojans.
> > [snip]
> > > (It is a shame that the people who got destroyed by the hidden men
> > > should in addition have their name sullied by being attached to the means of destruction.
> > > The horse should really have been called Ulysses's Horse, since it was
> > > his idea, he being a wiley artifacer, and the means of propagation should be
> > > called a Ulysses. )
> >
> > Possibilities:
> > 1. The horse was named after the battle.
> > 2. The horse was named after the city it was taken into.
> > 3. The horse was named after the people that were suckered in.
> > 4. Ulysses had better/worse PR (depending on your point of view).
> >
> > Many have heard the story of what allegedly happened to the cities of
> > Sodom and Gomorrah, and most people have heard of "sodomy", a practice
> > named after the city of Sodom, but nobody that I know of has named any
> > practice after the city of Gomorrah. I think that's unfair[1]. :)
> >
> > [1] Exactly *which* of the two cities it's unfair to is another matter.
>
> According to the Gay & Black Glossary (
> http://mindprod.com/ggloss/gomorrahy.html ), "gomorrahy" is "the
> Canadian legal term for fisting (both vaginal and anal insertion of a
> hand), footing (both vaginal and anal), and stumping (both vaginal and
> anal insertion of an amputated stump)." In other words, gomorrahy -
> a.k.a. the Sin of Gomorrah - is extremity insertion (it being understood
> that the penis is no more an extremity than it is a middle leg).

So, now I'll know in case that ever comes up on "Jeopardy".

...what is Gomorrahy, Alex? (Canada clue?)

mike4ty4
Wed Jun 02 21:29:18 CDT 2004

pmeister2@lycos.com (Peter Meister) wrote in message news:<c8e6db$2u5$00$1@news.t-online.com>...
> Ok, I know the difference between a virus and a trojan. But what is the difference between a worm
> and a trojan? Is the one a subset of the other type or are they completele different ?
>
> Peter

All viruses, including worms, can replicate once inside a computer.
Trojans are just programs that promise one thing but do something
completely different (and usually something bad) -- for instance a
program might promise to be a cool game but when executed it wipes
your hard disk. But they _do_not_replicate_. Viruses (including worms)
REPLICATE. Trojans do not. Since a virus and worm are pretty much the
same thing, a self-replicating program, the difference is in the means
of execution. File viruses simply piggyback on other programs within
the computer they infect, so they require the user to activate or copy
these programs to multiply and spread to other computers. Worm viruses
are 100% self-contained, they do not require piggybacking on another
program to be executed. Usually the user just executes the virus, it
installs itself into the registry, and proceeds to e-mail or otherwise
propagate itself. Trojans are just scraps of harmful code that do not
replicate at all. Trojans CAN NOT REPLICATE ON THEIR OWN. For the
analogy to a biological system, a virus/worm is the equivalent of a
biological virus, whereas a trojan is some sort of toxic chemical or
gene. The toxic chemical cannot make more of itself, but the virus
can.

mike4ty4
Wed Jun 02 21:31:48 CDT 2004

data64 <me@privacy.net> wrote in message news:<Xns94EEDB07994ECData64Bigfootcom@127.0.0.1>...
> pmeister2@lycos.com (Peter Meister) wrote in news:c8e6db$2u5$00$1@news.t-
> online.com:
>
> > Ok, I know the difference between a virus and a trojan.
>
> What is the difference between a virus and a worm ?
>


"Viruses" require the user to run them in order for them to replicate,
whereas a worm only requires one to activate it once: once it's
executed, it no loger requires the user for further launches.

kurt
Thu Jun 03 09:39:07 CDT 2004

mike3 wrote:
[snip]
> All viruses, including worms, can replicate once inside a computer.
> Trojans are just programs that promise one thing but do something
> completely different (and usually something bad) -- for instance a
> program might promise to be a cool game but when executed it wipes
> your hard disk.

correct so far...

> But they _do_not_replicate_.

neither replication nor non-replication is included as part of the
definition for trojan horse program so technically the replicative
capabilities of trojans are undefined...

it is merely a matter of convention that people use the term trojan to
refer to only non-replicating malware...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

T
Thu Jun 03 12:42:05 CDT 2004

Peter Meister wrote:

> Ok, I know the difference between a virus and a trojan. But what is the difference between a worm
> and a trojan? Is the one a subset of the other type or are they completele different ?
>
> Peter
>

That's easy. A trojan is a small rubber device that you put over your
worm before you connect it to an open socket.

If you don't put a trojan on your worm before you connect to an open
socket, you can get a virus.

--
Copyright 2004 T. Sean Weintz
This post may be copied freely without
the express permission of T. Sean Weintz.
T. Sean Weintz could care less.
T. Sean Weintz is in no way responsible for
the accuracy of any information contained in
any usenet postings claiming to be from
T. Sean Weintz. Users reading postings from
T. Sean Weintz do so at their own risk.
T. Sean Weintz will in no way be liable for
premature hair loss, divorce, insanity,
world hunger, or any other adverse relults
that may arise from reading any usenet
posting attributed to T. Sean Weintz

ALSO - FWIW, The following WHOIS Record is years out of date:
Weintz, Sean (SW2893) tweintz@MAIL.IDT.NET
Sean Weintz
462 Sixth Street , #A
Brooklyn, NY 11215

FromTheRafters
Thu Jun 03 23:17:31 CDT 2004


"mike3" <mike4ty4@yahoo.com> wrote in message news:1d54b7e4.0406021829.45a558f6@posting.google.com...
> pmeister2@lycos.com (Peter Meister) wrote in message news:<c8e6db$2u5$00$1@news.t-online.com>...
> > Ok, I know the difference between a virus and a trojan. But what is the difference between a worm
> > and a trojan? Is the one a subset of the other type or are they completele different ?
> >
> > Peter
>
> All viruses, including worms,

So you subscribe to the belief that worms are a subset of viruses?

> can replicate once inside a computer.

That is a given (sort of) - especially since we are talking about "computer"
viruses and worms, but what if a program is "broadcast" throughout a LAN?
Where is the replication taking place?

> Trojans are just programs that promise one thing but do something
> completely different (and usually something bad) --

It is better to say that they do something *other* than expected, as
this still leaves open the possibility that it does also what is expected.
"Completely different" might be interpreted as not performing the
expected.

> for instance a
> program might promise to be a cool game but when executed it wipes
> your hard disk.

....or plays the game while punching holes in your data.

> But they _do_not_replicate_.

This is not a part of the definition of trojan.

> Viruses (including worms)

Why not "worms (including viruses)"? :O)

I like to keep them separated myself.

> REPLICATE. Trojans do not.

Trojans are just about what you had stated previously, whatever they do
beyond that, is beyond the definition of trojan.

> Since a virus and worm are pretty much the same thing, a self-replicating
> program, the difference is in the means of execution.

No, they are different things, hence the different names.

> File viruses simply piggyback on other programs within
> the computer they infect, so they require the user to activate or copy
> these programs to multiply and spread to other computers.

They are not specifically programmed to spread to other computers?
Okay for "file viruses" (whatever they are), but not for viruses, BSI's
are known to spread from computer to computer as a matter of their
design.

> Worm viruses are 100% self-contained,

Some are fragmented, with parts executing on separate computers.

> they do not require piggybacking on another program to be executed.

Yes, unless you consider process injection to be "piggybacking". Many
worms require a certain process (with a vulnerable buffer) to be executing
for their code to be injected. But, I suppose *technically* a "process" isn't
a "program" in this sense.

...lets not go there.

> Usually the user just executes the virus, it installs itself into the registry,

A virus does not need to install, nor does it have any use for the registry.
It just executes when the program it has infected is executed (or has been
somehow requested to execute).

> and proceeds to e-mail or otherwise propagate itself.

Worms do this, viruses generally replicate and place their progeny
into a place where they in turn will execute when another program
(the one that is said to be "infected" by it) is asked to execute. It
is this "program infection" that mainly distinguises a virus from a
worm.

> Trojans are just scraps of harmful code that do not replicate at all.

They can do many things in addition to the "definiton" without becoming
"not trojans".

> Trojans CAN NOT REPLICATE ON THEIR OWN.

Then why are there sooo many of them? :oD <rimshot>

> For the analogy to a biological system,...[...]...

Unfortunately, the biological analogy fails on many levels.

FromTheRafters
Thu Jun 03 23:31:53 CDT 2004


"mike3" <mike4ty4@yahoo.com> wrote in message news:1d54b7e4.0406021831.80732a6@posting.google.com...
> data64 <me@privacy.net> wrote in message news:<Xns94EEDB07994ECData64Bigfootcom@127.0.0.1>...
> > pmeister2@lycos.com (Peter Meister) wrote in news:c8e6db$2u5$00$1@news.t-
> > online.com:
> >
> > > Ok, I know the difference between a virus and a trojan.
> >
> > What is the difference between a virus and a worm ?
> >
>
>
> "Viruses" require the user to run them in order for them to replicate,

Not part of the definition. Some viruses autoexecute.

> whereas a worm only requires one to activate it once: once it's
> executed, it no loger requires the user for further launches.

Again, not part of the definition. Some worms require user participation,
and some don't once they are initially set in motion.

Zvi
Fri Jun 04 03:16:06 CDT 2004

"FromTheRafters" <!0000@nomad.fake> wrote:

> > > > Ok, I know the difference between a virus and a trojan.
> > >
> > > What is the difference between a virus and a worm ?

There are several distinctions between virus and worm. A virus is *parasitic
code* that will reproduce *into host files*, with the host inheriting the
functionality of the virus. Typically, viruses will affect *multiple objects*
(files) *on the infected local machine*. Theoretically (with very few
exceptions), virus infected objects *can be cleaned* from the affecting virus
and restored to a pre-infected state. The key features for a virus to be one
are: parasitic code, affects hosts, and replicates.

Worms are *self contained code* that *replicates from one machine to another*.
Worms install a *single instance of themselves on an affected machine* and can't
be cleaned of host objects (there is none) but *removed, by deleting the worm's
object(s)* (some worms are implemented in several objects, that constitute a
single instance of the worm). The key features for a worm to be one are: self
contained code, single instance per platform, and replicates.

The above definitions do not apply to boot infectors, these are a separate
category of their own.

> > "Viruses" require the user to run them in order for them to replicate,
>
> Not part of the definition. Some viruses autoexecute.

They do not autoexecute, they are just invoked by some mandatory process, e.g.
loading the command interpreter under DOS, or the shell application under
Windows, machine run or runservices in Windows' startup, the 'autoexec' or
'FileOpen' macro in MS Office applications, etc. These, as well as others are
favorite places where to inject the initializing of the worm, or virus.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

T
Fri Jun 04 10:04:20 CDT 2004

Leythos wrote:
>>sean@snerts-r-us.org says...
>
>
> Can you please trim you signature to the proper length?
>

No. It's long for a reason.

Can you stop using a forged email address from a real domain with lame
delegation?

--
Copyright 2004 T. Sean Weintz
This post may be copied freely without
the express permission of T. Sean Weintz.
T. Sean Weintz could care less.
T. Sean Weintz is in no way responsible for
the accuracy of any information contained in
any usenet postings claiming to be from
T. Sean Weintz. Users reading postings from
T. Sean Weintz do so at their own risk.
T. Sean Weintz will in no way be liable for
premature hair loss, divorce, insanity,
world hunger, or any other adverse relults
that may arise from reading any usenet
posting attributed to T. Sean Weintz

ALSO - FWIW, The following WHOIS Record is years out of date:
Weintz, Sean (SW2893) tweintz@MAIL.IDT.NET
Sean Weintz
462 Sixth Street , #A
Brooklyn, NY 11215

Nuddystars
Fri Jun 04 12:42:48 CDT 2004


"T. Sean Weintz" <sean@snerts-r-us.org> wrote in message
news:10c13rl3ql54pf6@corp.supernews.com...
> Leythos wrote:
> >>sean@snerts-r-us.org says...
> >
> >
> > Can you please trim you signature to the proper length?
> >
>
> No. It's long for a reason.
>
> Can you stop using a forged email address from a real domain with lame
> delegation?
>
> --
> Copyright 2004 T. Sean Weintz
> This post may be copied freely without
> the express permission of T. Sean Weintz.
> T. Sean Weintz could care less.
> T. Sean Weintz is in no way responsible for
> the accuracy of any information contained in
> any usenet postings claiming to be from
> T. Sean Weintz. Users reading postings from
> T. Sean Weintz do so at their own risk.
> T. Sean Weintz will in no way be liable for
> premature hair loss, divorce, insanity,
> world hunger, or any other adverse relults
> that may arise from reading any usenet
> posting attributed to T. Sean Weintz
>
> ALSO - FWIW, The following WHOIS Record is years out of date:
> Weintz, Sean (SW2893) tweintz@MAIL.IDT.NET
> Sean Weintz
> 462 Sixth Street , #A
> Brooklyn, NY 11215

Just being helpful. There is a spelling mistake: `relults` should be
`results` obviously. As for the length of your sig., it`s nobody`s
business but your own. We are not Borg.

Paul :0)

T
Fri Jun 04 16:04:22 CDT 2004

Nuddystars wrote:

> Just being helpful. There is a spelling mistake: `relults` should be
> `results` obviously. As for the length of your sig., it`s nobody`s
> business but your own. We are not Borg.
>
> Paul :0)
>
>
Thanks. Didn't notice. But it could be argued those errors fall under
the "in no way responsible for the accuracy of any information" clause.

--
Copyright 2004 T. Sean Weintz
This post may be copied freely without
the express permission of T. Sean Weintz.
T. Sean Weintz could care less.
T. Sean Weintz is in no way responsible for
the accuracy of any information contained in
any usenet postings claiming to be from
T. Sean Weintz. Users reading postings from
T. Sean Weintz do so at their own risk.
T. Sean Weintz will in no way be liable for
premature hair loss, divorce, insanity,
world hunger, or any other adverse relults
that may arise from reading any usenet
posting attributed to T. Sean Weintz

ALSO - FWIW, The following WHOIS Record is years out of date:
Weintz, Sean (SW2893) tweintz@MAIL.IDT.NET
Sean Weintz
462 Sixth Street , #A
Brooklyn, NY 11215

T
Fri Jun 04 16:11:15 CDT 2004

Leythos wrote:


>
> Nope, been using that email address longer than the domain has been
> registered.

Not that it would ever happen, but if the owners of the domain wanted to
be bastards they could probably raise a stink about forgery. Technically
they'd be right.

I've seen people TOS'ed for dumber things. Then again i've seen outright
heinous stuff that folks didn't even get spanked for.

>
> Nice to see that you respect the usenet community you take part in.


Is that facetious? If so, just what is considered (by you of course) an
acceptable usenet signature length?
I frankly don't see what the big deal is. The whole sig is still under
1k, so I can't believe you see it as a bandwidth issue.


--
Copyright 2004 T. Sean Weintz
This post may be copied freely without
the express permission of T. Sean Weintz.
T. Sean Weintz could care less.
T. Sean Weintz is in no way responsible for
the accuracy of any information contained in
any usenet postings claiming to be from
T. Sean Weintz. Users reading postings from
T. Sean Weintz do so at their own risk.
T. Sean Weintz will in no way be liable for
premature hair loss, divorce, insanity,
world hunger, or any other adverse relults
that may arise from reading any usenet
posting attributed to T. Sean Weintz

ALSO - FWIW, The following WHOIS Record is years out of date:
Weintz, Sean (SW2893) tweintz@MAIL.IDT.NET
Sean Weintz
462 Sixth Street , #A
Brooklyn, NY 11215

kurt
Fri Jun 04 20:34:08 CDT 2004

T. Sean Weintz wrote:
> Leythos wrote:
[snip]
>> Nice to see that you respect the usenet community you take part in.
>
>
>
> Is that facetious? If so, just what is considered (by you of course) an
> acceptable usenet signature length?

rfc1855 suggest no more than 4 lines...

> I frankly don't see what the big deal is. The whole sig is still under
> 1k, so I can't believe you see it as a bandwidth issue.

rfc1855 explains why it suggests no more than 4 lines...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

FromTheRafters
Fri Jun 04 22:12:11 CDT 2004


"Zvi Netiv" <support@replace_with_domain.com> wrote in message news:ju70c05lsd0h4sevb7f60fi3sn45l8f5kt@4ax.com...

> There are several distinctions between virus and worm. A virus is *parasitic
> code* that will reproduce *into host files*, with the host inheriting the
> functionality of the virus. Typically, viruses will affect *multiple objects*
> (files) *on the infected local machine*. Theoretically (with very few
> exceptions), virus infected objects *can be cleaned* from the affecting virus
> and restored to a pre-infected state. The key features for a virus to be one
> are: parasitic code, affects hosts, and replicates.

Sounds good for "file viruses", and as I see below you like to keep
BSIs as a separate entity, so if you like to categorize in this manner
that is good. It helps to keep a clear difference when regarding the
methods imployed to deal with them. Inasmuch as the OP *did*
ask about "the difference" and not "the definition" this is entirely
acceptable as an answer in my opinion.

...but I *still* like the definition better. ;o)

> Worms are *self contained code* that *replicates from one machine to another*.
> Worms install a *single instance of themselves on an affected machine* and can't
> be cleaned of host objects (there is none) but *removed, by deleting the worm's
> object(s)* (some worms are implemented in several objects, that constitute a
> single instance of the worm). The key features for a worm to be one are: self
> contained code, single instance per platform, and replicates.

Clearly this is a distinction, and as above it is helpful in dealing with
them to categorize this way. This, and the one previous, don't even
look like definitions - but more like descriptions (damned good ones,
but still not definitive).

> The above definitions do not apply to boot infectors, these are a separate
> category of their own.

I don't accept them as definitions, and an almost perfectly good
definition of "virus" has nothing in it that precludes BSIs from
being viruses. Again, I see why it would be advantageous to
have BSIs as a separate entity because they are dealt with in
a different manner. Definitions don't particularly care what the
difficulties are when dealing with what they define - they just
define them. These characterizations are what I would expect
from someone that deals with prevention and/or removal, but
are (at least in my opinion) not defintions.

...and before anyone jumps all over me, I do realize that Zvi
is recognized by many as an expert, and I am admittedly just
a (quasi-anonymous) amateur user, ...but there it is...

mike3 said:

> > > "Viruses" require the user to run them in order for them to replicate,

FTR said:

> > Not part of the definition. Some viruses autoexecute.
>
> They do not autoexecute,

By autoexecute I only meant that no user action is required, as opposed
to the assertion by mike3.

> they are just invoked by some mandatory process, e.g.
> loading the command interpreter under DOS, or the shell application under
> Windows, machine run or runservices in Windows' startup, the 'autoexec' or
> 'FileOpen' macro in MS Office applications, etc. These, as well as others are
> favorite places where to inject the initializing of the worm, or virus.

...or the BIOS code passing program flow over to the boot sector.

Beauregard
Fri Jun 04 22:19:58 CDT 2004

Quoth the raven T. Sean Weintz:

> Is that facetious? If so, just what is considered (by you of course) an
> acceptable usenet signature length?

A simple google search turns up many pages, this one among them:
http://www.merlyn.demon.co.uk/news-use.htm#Sig
It says _four_ lines is a maximum.

> I frankly don't see what the big deal is. The whole sig is still under
> 1k, so I can't believe you see it as a bandwidth issue.

The bandwidth isn't the major issue, as I see it. It's that so many
people do not TRIM it and we all have to scroll an entire extra screen
to get to whatever they posted under it. That's annoying.

--
-bts
-This space intentionally left with two lines.

Zvi
Sat Jun 05 11:28:21 CDT 2004

"FromTheRafters" <!0000@nomad.fake> wrote:
> "Zvi Netiv" <support@replace_with_domain.com> wrote

> > There are several distinctions between virus and worm. A virus is *parasitic
> > code* that will reproduce *into host files*, with the host inheriting the
> > functionality of the virus. Typically, viruses will affect *multiple objects*
> > (files) *on the infected local machine*. Theoretically (with very few
> > exceptions), virus infected objects *can be cleaned* from the affecting virus
> > and restored to a pre-infected state. The key features for a virus to be one
> > are: parasitic code, affects hosts, and replicates.
>
> Sounds good for "file viruses", and as I see below you like to keep
> BSIs as a separate entity, so if you like to categorize in this manner
> that is good. It helps to keep a clear difference when regarding the
> methods imployed to deal with them. Inasmuch as the OP *did*
> ask about "the difference" and not "the definition" this is entirely
> acceptable as an answer in my opinion.
>
> ...but I *still* like the definition better. ;o)

What is *THE* definition and how did it come about?

> > Worms are *self contained code* that *replicates from one machine to another*.
> > Worms install a *single instance of themselves on an affected machine* and can't
> > be cleaned of host objects (there is none) but *removed, by deleting the worm's
> > object(s)* (some worms are implemented in several objects, that constitute a
> > single instance of the worm). The key features for a worm to be one are: self
> > contained code, single instance per platform, and replicates.
>
> Clearly this is a distinction, and as above it is helpful in dealing with
> them to categorize this way. This, and the one previous, don't even
> look like definitions - but more like descriptions (damned good ones,
> but still not definitive).
>
> > The above definitions do not apply to boot infectors, these are a separate
> > category of their own.
>
> I don't accept them as definitions, and an almost perfectly good
> definition of "virus" has nothing in it that precludes BSIs from
> being viruses. Again, I see why it would be advantageous to
> have BSIs as a separate entity because they are dealt with in
> a different manner. Definitions don't particularly care what the
> difficulties are when dealing with what they define - they just
> define them. These characterizations are what I would expect
> from someone that deals with prevention and/or removal, but
> are (at least in my opinion) not defintions.

Definitions are subjective and may vary, depending on the individual that
formulated them, as well as conditions for which the definition was made.

Descriptions are more objective as they are based on observation. A definition
can be derived from a description, but not necessarily the inverse.

For a concise glossary on AV terms check www.invircible.com/glossary.php

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

FromTheRafters
Tue Jun 08 09:41:13 CDT 2004


"Zvi Netiv" <support@replace_with_domain.com> wrote in message news:mdn3c0l22abnbu9htr1s03ab9201f0s4fb@4ax.com...
> "FromTheRafters" <!0000@nomad.fake> wrote:
> > "Zvi Netiv" <support@replace_with_domain.com> wrote
>
> > > There are several distinctions between virus and worm. A virus is *parasitic
> > > code* that will reproduce *into host files*, with the host inheriting the
> > > functionality of the virus. Typically, viruses will affect *multiple objects*
> > > (files) *on the infected local machine*. Theoretically (with very few
> > > exceptions), virus infected objects *can be cleaned* from the affecting virus
> > > and restored to a pre-infected state. The key features for a virus to be one
> > > are: parasitic code, affects hosts, and replicates.
> >
> > Sounds good for "file viruses", and as I see below you like to keep
> > BSIs as a separate entity, so if you like to categorize in this manner
> > that is good. It helps to keep a clear difference when regarding the
> > methods imployed to deal with them. Inasmuch as the OP *did*
> > ask about "the difference" and not "the definition" this is entirely
> > acceptable as an answer in my opinion.
> >
> > ...but I *still* like the definition better. ;o)
>
> What is *THE* definition and how did it come about?

"A computer virus is a self-replicating program containing code that
explicitly copies itself and that can "infect" other programs by
modifying them or their environment such that a call to an infected
program implies a call to a possibly evolved copy of the virus."

You can Google for fragments of this quote to see how many
places it appears (not that that really means anything), it seems
pretty popular.

I believe that it is an expanded version of the "plain language" definition
that was the best that Dr. Cohen could come up with to parallel the more
concise mathematical definition that he originally expounded. I assume
that he (and others) realized that the original "plain language" form left
worms as falling within the definition (whereas mathematically they were
not) and so the definition needed to be expanded so as to exclude the
worms.

..of course, I'm only guessing about that.

> For a concise glossary on AV terms check www.invircible.com/glossary.php

Thanks, I'll check that out.

T
Thu Jun 17 17:00:02 CDT 2004

kurt wismer wrote:

> T. Sean Weintz wrote:
>
>> Leythos wrote:
>
> [snip]
>
>>> Nice to see that you respect the usenet community you take part in.
>>
>>
>>
>>
>> Is that facetious? If so, just what is considered (by you of course)
>> an acceptable usenet signature length?
>
>
> rfc1855 suggest no more than 4 lines...

RFC1855 states it is a rule of thumb. Nothing more. It says it is such
because "many people pay for connectivity by the minute" -- which was
true in 1995, but not true in 2004.

--
T. Sean Weintz - T. Sean Weintz - T. Sean Weintz - T. Sean Weintz
May be copied freely without the express permission of T. Sean Weintz.
T. Sean Weintz could care less. T. Sean Weintz does reserve all rights.
T. Sean Weintz - T. Sean Weintz - T. Sean Weintz - T. Sean Weintz