Of Worms, Viruses, and Trojans

Posted on July 30, 2004
Filed Under Internet, Security |

On the 26th of July, a new variation of the Internet Worm “MyDoom” appeared. Unlike the previous versions of MyDoom, the new variation uses search engines to find email addresses that it can send itself to.

On the same day that Google announced the price range for its Initial public Offering, this new strain of MyDoom bombarded it with email address searches. The sheer volume of these searches made Google sporadically unavailable to some users over the course of the day.

We hear of new attacks like this on a regular basis nowadays. The terms Worm, Virus, and Trojan have become all too common buzz words in the computing world. These rogue programs can deny us access to services like Google, cause our computers to do things we’d prefer they didn’t, and in the worst case, cause us to lose data.

In order to protect from becoming a victim of such a threat, it is important to understand what these new buzzwords mean. If everyone judiciously guards against worms, viruses, and Trojans, their spread would be halted and eventually their authors would be forced to find better things to do.

It wasn’t long after personal computers first hit the market that viruses also appeared. A virus is programmed to replicate itself as well as do it’s damage or mischief. By Microsoft’s definition “A virus is a piece of computer code that attaches itself to a program or file so it can spread from computer to computer, infecting as it travels. Viruses can damage your software, your hardware, and your files.”

Viruses can infect other programs by in effect attaching itself to the other programs file or files. As a result, when the “host” program is run, the virus is run as well. This can be particularly effective when the host program is set to run at startup as the virus is able to launch itself every time the computer starts up.

There are also viruses that infect Microsoft Word and Excel documents and those that infect what’s known as the computers boot sector.  Viruses can be benign and cause little more than annoying messages or they can do damage to data and the operating system itself.

Viruses are designed to replicate themselves and often spread by the sharing of files or programs. When an infected file is opened or an infected program is run, the computer on which it is run or opened will become infected without proper protection.

A Trojan on the other hand does not replicate itself. The term comes from the Trojan horse that the Greeks used to conquer Troy and like it, a Trojan is a program that appears to be useful but is in reality, a menace. Some of the most insidious types of Trojans are those that are disguised as programs that remove viruses, worms or other Trojans.

Worms on the other hand are deigned to replicate themselves and to spread quickly. Worms are most often spread by email attachments. Rather than infecting a file on the computer as viruses do, the worm code is run when the attachment is opened. They usually do not attach to other programs but rather add new program files to the system and set them to run each time the computer starts. Worms almost invariably search the computer they are run on for email addresses and then send themselves to the addresses they find, attachment and all.

It is interesting to note that many worms will spoof the “from” address making it appear as though the message came from someone other than the real sender. By picking an email address at random the worm is able to make it very difficult to know exactly where the email came from.

To ward against viruses, Trojans, and worms it is vital to run antivirus software and be sure it is kept up to date. Recent worms like MSBlaster can also be blocked with a properly configured firewall and infection can be prevented by keeping the operating system diligently patched with Windows Update.

Comments

Copyright © 2007 Glen Bowes • Using Modernpaper theme created by Performancing