FromTheRafters said:
No.
It does not place a copy of itself on the server that it advertises via
it's spam links or postings.
It does not place a copy of itself on the destination PC.
It _wants_ for a copy of itself to end up on other PC's (as does all
malware) but it no more puts that copy there than the typical trojan
does for itself.
Correct, but it does copy itself (or has itself copied) and as
such it does "replicate".
No. Who-ever controls the spamvertised server has put a copy of Koob on
that server. When a new PC becomes infected, that copy came from a
server - not some other infected PC.
A worm does not require the use of a third PC when spreading from
machine 1 to machine 2.
The fact of replication is separate from the method of
replication.
Worms are not served. Trojans are served. Koob is a trojan.
The fact of replication makes it a worm or virus.
Explain how I can have any form of malware end up on my PC _without_
replication.
Your use of the concept of "replication" is strange in this context.
The lack of attaching the replicant to host code is what
makes it a worm rather than a virus.
The requirment for it to need a server to spread makes it a trojan and
not a worm.
Unless you are one that views the virus as a superset of worms
(all worms are viruses but not vice versa).
From what I can tell, there is no clear definition of virus that
sufficiently or clearly delineates it from either trojan or worm.
Only trojans and worms appear to have a few clear distinctions in terms
of how they spread and the level of operator intervention required. In
that regard, a true worm can spread from PC-1 to PC-2 without the aid of
a third PC to act as a server and without the need for human activity or
action. Koob is not such a worm.
Yes, in fact the mere placing of a replicant in a shared
directory (Kazaa worms) can have the same end result -
I asked if transmitting or posting a URL qualifies as a worm
transmission method. You said yes, and then you immediately went on to
describe file copying to shared directories. The two are hardly the
same phenomena. So you'd better come up with a better answer because
that one didn't work.
Trojans are considered non-replicating malware, so this is a
worm (no host program "infection" so not a virus - unless as
above...).
Koob does not replicate itself. It tricks people into downloading more
copies of itself from a server. Koob requires a functioning server with
known coordinates in order to spread. A true worm seeks out on it's own
the next destination PC and directly transmits a copy of itself to that
PC. Koob does not do this.
Why are you so insistent on making a case that koob is a worm, to the
extent of stretching the definition of what a worm is?
Different segments of an overall program can be running
on different machines and together constitute a worm
program.
Your answer was as clear as mud. Please reformulate and restate your
response to that question.
Besides, with polymorphism "exact duplicates" are not
common.
Worms don't need polymorphism if they are leveraging an exploit that
sucessfully allows themselves to spread from one PC to the next without
human intervention.
