Fighting a terminology battle against the antivirus companies for the
minds of the users is just not my chosen war. If it's yours, go for
it.
Nah, they wouldn't listen to me anyway. Besides, when the curious use AV
websites to investigate exactly what the differences are - they end up so
confused that they come here asking for clarification. Then it is interesting to
observe how everyone seems to know the "correct" answer - and yet they
are greeted with examples that don't fit the definitions that have been laid out.
The AV community has reasons for the classifications that they use, but
they *do* seem to be logically inaccurate.
In this particular case, since the new file is not being set up to run
in place of the system file,
Viruses don't need to ensure that the program that they "infect" is
ever executed - only that *if* the program is asked to be executed
the virus will be executed as a result
isn't the system file there merely as distraction material to hopefully
obscure the worm body?
Perhaps, or it is good enough packaging for a trojan, or it is just acting
like a hermit crab (hey - nice can...aluminum siding...). It is funny that
both appending and prepending is mentioned in Symantec's description.
It prepends itself to host executables, and if the particular instance is
running from an "infected" executable, the program detects that the
(host?) executable is appended to the worms executable image and
will detach and execute that detached executable.
....sounds very viruslike to me indeed.
I don't know how a legitimate msconfig or regedit would get infected
though.
So who is infecting whom here?
It apparently "infects" exefiles in download directories, shared ones, and
some other directories too (like the desktop).
Yes, I'm being facetious. Sort of.
It does make you wonder.
I've noticed this recently with a few other worms. At first I
thought, "Now what the heck is THAT supposed to mean?" But reading
closely for what's happening to these "appended" files in the end
result provided the explanation well enough. I guess we shouldn't
complain too much, since they don't have to make their descriptions
available to the public at all.
True, but I do wish that they wouldn't treat these as mutually exclusive
entities, and at the same time say such and such is infected by the
"Backdoor Trojan Worm Virus" or something similar.
You may have noticed that Sophos doesn't bother mentioning this
unimportant "appending" feature of the worm - that way they don't have
to name it either way, I suppose. <G>
They don't make it at all clear that previously legitimate programs on the
local machine (such as msconfig.exe) could have been modified.
....if this is indeed the case (which is what I understand in the Symantec
write-up).
(