Viruses/Worms/Trojans

What is the difference between viruses, worms, and Trojans?

What Is a Virus?

A virus is a program that is capable of replicating with little or no user intervention, and the replicated programs also replicate further.  There is typically a piece of code that causes an unexpected, usually malicious, event (payload) to occur. Viruses are often disguised as games or images with clever marketing titles such as "Pictures of ME".

Virus:  Replicates file-to-file, system-to-system, or disk-to-disk, typically requires a "host", must be executed, may cause a symptom or damage (payload).

Virus Hoax

Not a Virus

top

What Is a Worm?

A worm is a virus that spreads by creating duplicates of itself on other drives, systems, or networks.  Worms may send copies of themselves to other computers across network connections, through e-mail, through an infected Web page, or through instant messages and internet Relay Chat (IRC).  Some worms are differentiated as being "@m" or "@mm", which signifies that their primary distribution method is through electronic "mail" or "mass-mail."

top

What is a Trojan Horse?

A Trojan Horse is a program that either pretends to have, or is described as having, a set of useful or desirable features, but actually contains a damaging payload.  True Trojan Horses are not technically viruses, since they do not replicate; however, many viruses and worms use Trojan Horse tactics to initially infiltrate a system.  Although Trojan Horses are not technically viruses, they can be just as destructive.

Trojan Horse:  Deliberately does something unexpected...they steal passwords, delete files, open backdoors, connect to external sites, do not replicate; malicious intent is what make code a Trojan Horse.

top

What Is a Virus Hoax?

There are a lot of viruses out there.  But some aren't really out there at all.  Virus hoaxes are more than mere annoyances.  They may lead some users to routinely ignore all virus warning messages, leaving them vulnerable to a genuine, destructive virus.

Next time you receive an urgent virus warning message, be sure to check the list of known virus hoaxes.  A common hoax is the jdbgmgr.exehoax.  It describes an otherwise legitimate system file as being a virus that "is not detected by McAfee or Norton and it stays quiet for 14 days before damaging the system."  The file in question, coincidently, is displayed with a teddy bear icon and is often convincing as a result.

Remember to never open an email attachment unless you know what it is -- even it it's from someone you know and trust. 

Some of the common phrases used in these hoaxes are:

• Hardware problems.  There are currently no viruses that can physically damage computer hardware, such as chips, boards, and monitors.
• The computer beeps ar startup with no screen display.  This is usually caused by a hardware problem during the boot process.  Consult your computer documentation for the meaning of the beep codes.
• The computer does not register 640 K of conventional memory.  This can be a sign of a virus, but it is not conclusive.  Some hardware drivers such as those for the monitor of SCSI card can use some of this memory.  Consult with your computer manufacturer or hardware vendor to determine if this is the case.
• You have two antivirus programs installed and one of them reports a virus.  While this could be a virus, it can also be caused by one antivirus program detecting the other program's signatures in memory.
• You are using Microsoft Word, and Word warns you that a document contains a macro.  This does not mean that the macro is a virus.
• You are not able to open a particular document.  This is not necessarily an indication of a virus.  Try opening another document or a backup of the document in question.  If other documents open correctly, the document may be damaged.
• The label on a hard drive has changed.  Every disk is allowed to have a label. You can assign a label to a disk by using the DOS label command.

top