The most common blunder people make when the topic of a computer virus arises is to refer to a worm or Trojan

horse as a virus. While the words Trojan, worm and virus are often used interchangeably, they are not exactly the same. Viruses, worms and Trojan Horses are all malicious programs that can cause damage to your computer, but there are differences among the three, and knowing those differences can help you to better protect your computer from their often damaging effects.

What Is a Virus?
A computer virus attaches itself to a program or file enabling it to spread from one computer to another, leaving infections as it travels. Like a human virus, a computer virus can range in severity: some may cause only mildly annoying effects while others can damage your hardware, software or files. Almost all viruses are attached to an executable file, which means the virus may exist on your computer but it actually cannot infect your computer unless you run or open the malicious program. It is important to note that a virus cannot be spread without a human action, (such as running an infected program) to keep it going. People continue the spread of a computer virus, mostly unknowingly, by sharing infecting files or sending e-mails with viruses as attachments in the e-mail.

What Is a Worm?
A worm is similar to a virus by design and is considered to be a sub-class of a virus. Worms spread from computer to computer, but unlike a virus, it has the capability to travel without any human action. A worm takes advantage of file or information transport features on your system, which is what allows it to travel unaided. The biggest danger with a worm is its capability to replicate itself on your system, so rather than your computer sending out a single worm, it could send out hundreds or thousands of copies of itself, creating a huge devastating effect. One example would be for a worm to send a copy of itself to everyone listed in your e-mail address book. Then, the worm replicates and sends itself out to everyone listed in each of the receiver's address book, and the manifest continues on down the line. Due to the copying nature of a worm and its capability to travel across networks the end result in most cases is that the worm consumes too much system memory (or network bandwidth), causing Web servers, network servers and individual computers to stop responding. In recent worm attacks such as the much-talked-about Blaster Worm, the worm has been designed to tunnel into your system and allow malicious users to control your computer remotely.

What Is a Trojan horse?

A Trojan Horse is full of as much trickery as the mythological Trojan Horse it was named after. The Trojan Horse, at first glance will appear to be useful software but will actually do damage once installed or run on your computer. Those on the receiving end of a Trojan Horse are usually tricked into opening them because they appear to be receiving legitimate software or files from a legitimate source. When a Trojan is activated on your computer, the results can vary. Some Trojans are designed to be more annoying than malicious (like changing your desktop, adding silly active desktop icons) or they can cause serious damage

by deleting files and destroying information on your system. Trojans are also known to create a backdoor on your computer that gives malicious users access to your system, possibly allowing confidential or personal information to be compromised. Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate.
Common Characteristics
In order to be classified a computer virus, a program must meet two qualifications. First, it must be able to execute itself by inserting its malicious code in the execution path of another application. Secondly, it must be able to self replicate by replacing existing files with copies of files containing the viral code. Similar to how a biological virus needs to find a host cell, a computer virus must find an infected host file to propagate itself and further spread the infection. Viruses have become very common in the world of computing, infecting millions of machines since their inception. However, the virus is not alone, as it has another destructive partner: the computer worm. A worm is very similar to a virus, yet quite distinctive as well. Unlike a virus, the computer worm does not require a host file in order to propagate itself. It is able to enter a computer through system vulnerabilities and uses those flaws to propagate. The typical computer virus must be activated by way of user intervention. This may include doubleclicking on a website link or opening the attachment of an email message. A worm bypasses user intervention by releasing a document containing the infected macro and distributing itself from computer to computer. A computer virus is generally the most harmful of the two, although worms have been known to cripple entire networks due to multiple infections.

It must execute itself. It will often place its own code in the path of execution of another program. It must replicate itself. For example, it may replace other executable files with a copy of the virus infected file. Viruses can infect desktop computers and network servers alike. Worms are programs that replicate themselves from system to system without the use of a host file. This is in contrast to viruses, which requires the spreading of an infected host file. Although worms generally exist inside of other files, often Word or Excel documents, there is a difference between how worms and viruses use the host file. Usually the worm will release a document that already has the "worm" macro inside the document. The entire document will travel from computer to computer, so the entire document should be considered the worm.

Whats a Trojan Horse virus?

Wednesday May 31, 2006

I came across this gem on the Visa website:

Trojan Horse virus Whats a Trojan Horse virus? A Trojan Horse is an email virus usually released by an email attachment. If opened, it will scour your hard drive for any personal and financial information such as your social security, account, and PIN numbers. Once it has collected your info, it is sent to a thiefs database. Now, there are Trojan Horses and there are viruses, but there's no such thing as a Trojan Horse virus. In fact, the very definition of each precludes any chance of there being such a thing. A Trojan does not replicate. Viruses do. That fact alone means there can never be a "Trojan Horse virus". The Visa description continues with, "A Trojan Horse is an email virus usually released by an email attachment." Not so. A Trojan may be sent as an attachment in email, but it's certainly not an email virus. (In fact there are few true email viruses, but that's a whole other topic). So it may or may not arrive in email, and it's equally likely to have been downloaded from a website or resulted from a P2P file transfer. In other words, vector has nothing to do with whether something is or isn't a Trojan. Just what is a Trojan then? A Trojan is a program that appears to be legitimate, but in fact does something malicious. Quite often, that something malicious involves gaining remote, surreptitious access to a user's system. Unlike viruses, a Trojan does not replicate (i.e. infect other files), nor does it make copies of itself as worms do. There are several different types of Trojans. Some of these include: remote access Trojans (RATs), backdoor Trojans (backdoors), IRC Trojans (IRCbots), and keylogging Trojans. Many Trojan encompass multiple types. For example, a Trojan may install both a keylogger and a backdoor. IRC Trojans are often combined with backdoors and RATs to create collections of infected computers known as botnets. But one thing you probably won't find a Trojan doing is scouring your hard drive for personal details, as the Visa description alleges. Contextually, that would be a bit of a trick for a Trojan. Instead, this is where the keylogging functionality most often comes into play - capturing the user's keystrokes as they type and sending the logs to the attackers. Some of these keyloggers can be pretty sophisticated, targeting only certain websites (for example) and capturing any keystrokes involved with that particular session. But why is it important to know the difference between a virus, a worm, and a Trojan? Because a virus infects legitimate files, thus