What is the difference between a worm and a trojan ?

> > Ok, I know the difference between a virus and a trojan. But what is the difference between a worm
> > and a trojan? Is the one a subset of the other type or are they completele different ?

When I were a lad:
A virus was parasitic on some existing program, and (usually) multiplied
within one machine. Transmission to other machines was more-or-less by
chance.
A trojan is a complete standalone program, and pretends to be something
you want so that you take it into your machine explicitly.
A worm's main activity is to move from machine to machine.

--
Per ardbeg ad annullo
 >> Stay informed about: What is the difference between a worm and a trojan ? 

Ben wrote:

> On 18 May 2004 13:31, Peter Meister wrote:
>
>>Ok, I know the difference between a virus and a trojan. But what is
>>the difference between a worm and a trojan? Is the one a subset of the
>>other type or are they completele different ?
>>
>>Peter
>
>
> A worm is a self-replicating piece of code

yes...

> that doesn't require the user
> to take action in order to activate it.

that part is debatable... if you add that criteria we're left with a
wide variety of self-replicating malware that has no classification...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"
 >> Stay informed about: What is the difference between a worm and a trojan ? 

<Ben M. Schorr>; "MVP-OneNote" <bens.TakeThisOut@bogusaddress.mvp> wrote in message news:4905df3b05484681b62000eeb2fef9d8@ghytred.com...
> On 18 May 2004 13:31, Peter Meister wrote:
> >Ok, I know the difference between a virus and a trojan. But what is
> >the difference between a worm and a trojan? Is the one a subset of the
> >other type or are they completele different ?
> >
> >Peter
>
> A worm is a self-replicating piece of code that doesn't require the user
> to take action in order to activate it.

Many worms require human interaction in order to function, in fact
most of the more common ones do. The most pure forms of worm
do infact do as you say, however it is not a defining factor.

> It infects a machine, then goes looking for other machines to infect,

Some definitions do indeed say this, but it is an inadequate definition
because some worms don't do *this* either.

> all the while unattended and most likely unnoticed by the user.

Superfluous, but not incorrect.

> Worms are typically self-contained; i.e. they don't infect other files.

Usually referred to as "does not *need* to infect programs", as opposed
to viruses which *do* need to infect programs.

(files are not the only things that can be considered programs)

> A trojan is a program that appears to be something it's not;

....or is something else in addition to what it appears to be.
 >> Stay informed about: What is the difference between a worm and a trojan ? 

pmeister2.RemoveThis@lycos.com (Peter Meister) wrote in news:c8e6db$2u5$00$1@news.t-
online.com:

> Ok, I know the difference between a virus and a trojan.

What is the difference between a virus and a worm ?

data64
 >> Stay informed about: What is the difference between a worm and a trojan ? 

data64 wrote:

> pmeister2.DeleteThis@lycos.com (Peter Meister) wrote in news:c8e6db$2u5$00$1@news.t-
> online.com:
>
>
>>Ok, I know the difference between a virus and a trojan.
>
>
> What is the difference between a virus and a worm ?

both are self-replicating malware... a virus must be able to 'infect' a
host 'program' and a worm must be able to reproduce without infecting
a host program (where 'program' is understood to mean 'a sequence of
executable or interpretable instructions' and 'infect' is understood to
mean 'attach to a host in such a way that when an attempt is made to
execute the host the infector executes as well as or instead of the
host')...

of course these are not mutually exclusive, a worm that can also infect
or a virus that can also spread without infecting is allowed -
worm/virus hybrids are sometimes lumped into the blanket term 'blended
threat'...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"
 >> Stay informed about: What is the difference between a worm and a trojan ? 

>
>>A trojan is a program that appears to be something it's not;
>
>
> ...or is something else in addition to what it appears to be.
>
>
and doesn't replicate.

--
William

If it don't work, hit it.
If it still don't work, kick it.
If it works after that, than it doesn't matter if that helped, what's
important is it works.
 >> Stay informed about: What is the difference between a worm and a trojan ? 

"Big Will" wrote in message news:40ac7d4b$1@darkstar...
> >
> >>A trojan is a program that appears to be something it's not;
> >
> >
> > ...or is something else in addition to what it appears to be.
> >
> >
> and doesn't replicate.

Replication does not remove its trojianic properties. Hybris is a
trojan, and a worm, and in some cases also a virus.
 >> Stay informed about: What is the difference between a worm and a trojan ? 

Big Will wrote:

>>
>>> A trojan is a program that appears to be something it's not;
>>
>> ...or is something else in addition to what it appears to be.
>>
> and doesn't replicate.

not necessarily...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"
 >> Stay informed about: What is the difference between a worm and a trojan ? 

kurt wismer wrote:
<...>
> of course these are not mutually exclusive, ...

That's one reason why the taxonomy of malware has lost its meaning. Many
of them try to do many things.

Once upon a time there were distinctions. The difference between a virus
and trojan was in motivation. Viruses try to spread as much as possible,
and often send information about their hosts to the attacker. Trojans
try to give control of the infected machine to the attacker.

The subdivision virus vs. worm was historic. First viruses had to store
themselves on floppies, because sneakernet was the only medium
available. When networked computers became common, it was enough to
infect a running application instance (worm). You could get rid of a
worm by turning power off.

But as mentioned, the differences don't count anymore.

-- Lassi
 >> Stay informed about: What is the difference between a worm and a trojan ? 

Lassi Hippeläinen wrote:

> kurt wismer wrote:
> <...>
>
>>of course these are not mutually exclusive, ...
>
>
> That's one reason why the taxonomy of malware has lost its meaning. Many
> of them try to do many things.
>
> Once upon a time there were distinctions. The difference between a virus
> and trojan was in motivation. Viruses try to spread as much as possible,
> and often send information about their hosts to the attacker. Trojans
> try to give control of the infected machine to the attacker.

i'm afraid you are mistaken...
a) you're apparently mistaking backdoor trojans for all trojans - not
all are intended to give remote access, that's a relatively new
capability...
b) virus infection creates a trojan out of the host program - it always
has done...

> The subdivision virus vs. worm was historic. First viruses had to store
> themselves on floppies, because sneakernet was the only medium
> available.

viruses didn't have to do any such thing... viruses infected programs,
they always did... those programs may be on the floppy disk or the user
may later move them on to a floppy disk... regardless, programs were
shared often enough that no special effort needed to be made to ensure
distribution between machines...

> When networked computers became common, it was enough to
> infect a running application instance (worm). You could get rid of a
> worm by turning power off.

that's an issue of how it's implemented, not how it's defined...

> But as mentioned, the differences don't count anymore.

respectfully, i think it may be that you were misunderstanding the
differences in the first place... it's not hard, there are no end of
computer jargon files out there that people think are authoritative but
are in fact woefully inadequate when they attempt to cover this field
with a few short lines... i've been following this field for the past
15 years and i can't think of a single instance of a major redefinition
of any of the principle concepts (virus, worm, or trojan) during that
time...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"
 >> Stay informed about: What is the difference between a worm and a trojan ? 

kurt wismer wrote:

> i'm afraid you are mistaken...

No, I was simplifying (maybe too far). I tried to show the architectural
differences in malware types. But as mentioned, they doesn't matter
anymore, because today the buggers can mix all of the features.

-- Lassi (who started with Teletypes and punched tape in 1972)
 >> Stay informed about: What is the difference between a worm and a trojan ? 

alun RemoveThis @texis.invalid (Alun Jones [MS MVP - Security]) writes:

]In article <40AC7297.663853F6 RemoveThis @welho.organized.invalid>, Lassi
]=?iso-8859-1?Q?Hippel=E4inen?=
] <lassi.hippelainen RemoveThis @welho.organized.invalid> wrote:
]>Once upon a time there were distinctions. The difference between a virus
]>and trojan was in motivation. Viruses try to spread as much as possible,
]>and often send information about their hosts to the attacker. Trojans
]>try to give control of the infected machine to the attacker.

]In particular, a Trojan is generally targeted at the one person or machine
]that gets the malware. Viruses and worms are meant to distribute
]themselves. In its operation, a virus creates a trojan.

?? Trojan-- From Trojan horse-- When the greek city troops could not
breach teh walls of Troy, they left with a gift to the Trojans to
propitiate them of a giant wooden horse. The Trojans pulled the horse
into the city. That night the greeks hidden in the horse came out,
opened the gates ofthe city and Troy was destroyed.

By analogy, an attractive programme which contains hidden within it a
piece of malware, so when the attractive program is run, the malware is
also run, breaching the security of the machine. It is something which
requires the action of accepting and running the attractive offering to
bring up the malware. Many email "viruses" propagate via trojans.

A worm is something which finds a soft entry and tunnels into a machine.
Ie, it propagates via hidden defects in the software of the system.
The old Morris sendmail would I think be a worm.

Ie, worms and trojans refer to the method of propagation. A virus could
propagate by means of a trojan. A virus could replicate by means of
trojans.

(It is a shame that the people who got destroyed by the hidden men
should in addition have their name sullied by being attached to the means of destruction.
The horse should really have been called Ulysses's Horse, since it was
his idea, he being a wiley artifacer, and the means of propagation should be
called a Ulysses. )
 >> Stay informed about: What is the difference between a worm and a trojan ? 

FromTheRafters wrote:

> "Big Will" wrote in message news:40ac7d4b$1@darkstar...
>
>>>>A trojan is a program that appears to be something it's not;
>>>
>>>
>>>...or is something else in addition to what it appears to be.
>>>
>>>
>>
>>and doesn't replicate.
>
>
> Replication does not remove its trojianic properties. Hybris is a
> trojan, and a worm, and in some cases also a virus.
>
>
According to many of the definitions I've read, the malware must not
replicate in order for it to be a trojan. Otherwise, worms such as Swen
would be considerred trojans.

--
William

If it don't work, hit it.
If it still don't work, kick it.
If it works after that, than it doesn't matter if that helped, what's
important is it works.
 >> Stay informed about: What is the difference between a worm and a trojan ?