Trojan Horses Definitions

Since "Trojan Horses" (or Backdoors) have been in the news just recently, the term probably sounds familiar to you. But perhaps you¡¯re not quite sure what a Trojan Horse is and what damage it is capable of doing to your system. Trojan Horses, of which there are now more than one thousand in circulation (including modifications and variants), are a relatively new and probably the most dangerous strain of viruses that have appeared in recent times. They also threaten to overwhelm systems that only run anti-virus applications and firewalls as a means of combating the threat. Today's Trojans as they are commonly referred to as, have now attained such a degree of sophistication that they pose a real threat to any user who hasn't taken adequate precautions to protect their data.

The name "Trojan Horse" derives itself from a page in Greek history when the Greeks had lain siege to the fortified city of Troy for over ten years. Their spy, a Greek called Sinon offered the Trojans a gift in the form of a wooden horse and convinced them that by accepting it, they would become invincible. The horse though was hollow and was occupied by a contingent of Greek soldiers. When they emerged in the dead of night and opened the city gates, the Greeks swarmed in, slaughtered its citizens and subsequently pillaged, burned and laid waste to the city.

In the IT environment, the Trojan Horse acts as a means of entering the victim¡¯s computer undetected and then allowing a remote user unrestricted access to any data stored on the user's hard disk drive whenever he or she goes online. In this way, the user gets burned and like the unfortunate citizens of Troy, may only discover that fact when it is too late.

These types of viruses were originally designed as a means of self expression by gifted programmers and did little more than to cause the system to lock up, behave abnormally in a specific way or perhaps cause loss of data on the user¡¯s machine.

Nowadays though, Trojans have a much more sinister purpose. Their primary objective is to allow a remote user a means gaining access to a victim's machine without their knowledge. Once that has been achieved, the intruder can do anything with the machine that the user can do. An intruder's usual objective is to browse the user's hard drive in order to detemine if there is anything of value stored on it. That could be almost anything such as valuable research papers, credit card details or passwords to restricted web sites for example. If anything of value is found, then the intruder can copy the data to his own hard drive in exactly the same way that the user can copy a file to a floppy disk. The worse thing is that all these processes are hidden from the user who might be sitting in front of his own machine working on an entirely different document at the time. Unusual hard drive activity for no apparent reason may be the only indication that something is happening that shouldn't be happening.

The intruder can also cause havoc to the system by deleting (system) files, erasing valuable data or ultimately destroying the hard drive. Simply adding a command to the autoexec.bat file can do that. The next time the unsuspecting victim boots the computer, it will automatically run the format command. Adding a certain flag to that command will also render the hard disk unusable.

Passwords offer no protection at all because today's Trojans are capable of recording the victim¡¯s keystrokes and then transmitting the information back to the intruder. Those passwords can subsequently be deciphered by the Trojan and even changed in order to prevent the user getting access to his own files!

How did I get it?

Trojans are executable programs, which means that when you open the file, it will perform some action(s). In Windows, executable programs have file extensions like "exe", "vbs", "com", "bat", etc. Some actual trojan filenames include: "dmsetup.exe" and "LOVE-LETTER-FOR-YOU.TXT.vbs" (when there are multiple extensions, only the last one counts, be sure to unhide your extensions so that you see it). More information on risky file extensions may be found at this Microsoft document.

Trojans can be spread in the guise of literally ANYTHING people find desirable, such as a free game, movie, song, etc. Victims typically downloaded the trojan from a WWW or FTP archive, got it via peer-to-peer file exchange using IRC/instant messaging/Kazaa etc., or just carelessly opened some email attachment. Trojans usually do their damage silently. The first sign of trouble is often when others tell you that you are attacking them or trying to infect them!

What is the harm if I'm infected?

A Trojan has two parts: server and client. The server part is a program or file that is installed on the prospective but unknowing victim's machine to infect it. The client part is on the attacker's system. This combination of software establishes a connection between the victim's machine and the attacker via the Internet.

Using a Trojan, an attacker can do almost the same actions remotely on the infected computer as if he were right there directly using it. The attacker can copy, view and delete information from the hard drive, run various applications, change configurations and settings, control the infected computer's hardware and much more. Moreover, it can all be done without the infected computer's user being aware that his computer is being accessed remotely. Often it requires a security expert to discover the situation. Typically Trojan horses are distributed over the Internet as small utility programs, screen-savers, and wallpaper for desktops. It just takes one of these for a cracker to access your system and vandalize it.

How do I avoid getting infected in the future?

To avoid being infected with a Trojan, download and execute files only from trusted sources. You should also install and use: anti-virus programs, anti-Trojan software and a firewall.

How do I get rid of trojans?!?

Here are your many options, none of them are perfect. I strongly suggest you read through all of them before rushing out and trying to run some program blindly. Remember - that's how you got in this trouble in the first place. Good luck!

Clean Re-installation: Although arduous, this will always be the only sure way to eradicate a trojan or virus. Back up your entire hard disk, reformat the disk, re-install the operating system and all your applications from original CDs, and finally, if you're certain they are not infected, restore your user files from the backup. If you are not up to the task, you can pay for a professional repair service to do it.

Anti-Virus Software: Some of these can handle most of the well known trojans, but none are perfect, no matter what their advertising claims. You absolutely MUST make sure you have the very latest update files for your programs, or else they will miss the latest trojans. Compared to traditional viruses, today's trojans evolve much quicker and come in many seemingly innocuous forms, so anti-virus software is always going to be playing catch up. Also, if they fail to find every trojan, anti-virus software can give you a false sense of security, such that you go about your business not realizing that you are still dangerously compromised. There are many products to choose from, but the following are generally effective: AVP, PC-cillin, and McAfee VirusScan. All are available for immediate downloading typically with a 30 day free trial. Please visit our Anti-Virus review page to discover reputable products that will completely protect you against this threat.

Anti-Trojan Programs: These programs specialize in trojans instead of general viruses. For the same reasons, some of these programs are effective against most trojans, but none of them will ever be effective against all trojans.

IRC Help Channels: If you're the type that needs some hand-holding, you can find trojan/virus removal help on IRC itself, such as EFnet #dmsetup or DALnet #NoHack. These experts will try to figure out which trojan(s) you have and offer you advice on how to fix it.