All about Trojan Horse

Trojan horse

A Trojan is a program that appears to be legitimate, but in fact does something malicious. Quite often, that something malicious involves gaining remote, surreptitious access to a user's system. Unlike viruses, a Trojan does not replicate (i.e. infect other files), nor does it make copies of itself as worms do.

There are several different types of Trojans. Some of these include: remote access Trojans (RATs), backdoor Trojans (backdoors), IRC Trojans (IRCbots), and keylogging Trojans. Many Trojan encompass multiple types. For example, a Trojan may install both a keylogger and a backdoor. IRC Trojans are often combined with backdoors and RATs to create collections of infected computers known as botnets.

But why is it important to know the difference between a virus, a worm, and a Trojan? Because a virus infects legitimate files, thus if antivirus software detects a virus, that file should be cleaned. Conversely, if antivirus software detects a worm or a Trojan, there is no legitimate file involved and action should be to delete the file.

Type of Trojan horse

• Remote Access Trojans
• Data Sending Trojans
• Destructive Trojans
• Proxy Trojans
• FTP Trojans
• security software disabler Trojans
• denial-of-service attack (DoS) Trojans

1.Abbreviated as RATs, a Remote Access Trojan is one of seven major types of Trojan horse designed to provide the attacker with complete control of the victim's system. Attackers usually hide these Trojan horses in games and other small programs that unsuspecting users then execute on their PCs

2. A type of a Trojan horse that is designed to provide the attacker with sensitive data such as passwords, credit card information, log files, e-mail address or IM contact lists. These Trojans can look for specific pre-defined data (e.g., just credit card information or passwords), or they could install a keylogger and send all recorded keystrokes back to the attacker.

3. A type of Trojan horse designed to destroy and delete files, and is more like a virus than any other Trojan. It can often go undetected by antivirus software.

4. A type of Trojan horse designed to use the victim's computer as a proxy server. This gives the attacker the opportunity to do everything from your computer, including the possibility of conducting credit card fraud and other illegal activities, or even to use your system to launch malicious attacks against other networks.

5. A type of Trojan horse designed stop or kill security programs such as an antivirus program or firewall without the user knowing. This Trojan type is normally combined with another type of Trojan as a payload.
Easy way to test antivirus scanner



Protection against Trojan

The most effective option for protecting against a Trojan horse may be installing a firewall if you do not already have one. A good software firewall is usually the best type for a personal computer. It can be configured to keep intruders out while also keeping your system, or programs within your system, from sending out personal or confidential data.
If you are unsure, test drive a trial version of a firewall or download a free one to check it out. Run it for one day and examine the log file
Probably the biggest line of defense for helping prevent having your computer infected with a Trojan Horse or other malicious software is being careful what you do online. Avoid using file sharing sites using the Gnutella network to download free movies, MP3 music files, etc. These sites are notorious for containing files infected with malware, including Trojan Horses. Use caution when downloading files off Usenet. Also, be careful what you freeware you download. That cool game could very well contain more than you bargained for - a Trojan Horse or other malicious software. Only download programs from reputable sources. Never accept programs transferred by instant messaging applications. Finally, never open an email attachment from someone you don't know. In fact, never open an email attachment from even someone you know that is unfamiliar and/or unexpected, as their system could be infected with a Trojan Horse or other malware. Confirm that the sender did actually send you the email before opening.
Ensure that you have anti-spyware software installed on your computer. Maximum PC actually recommends you have Spybot Search & Destroy as well as two other anti-spyware programs installed on your computer. It is good to know that there are free anti-spyware programs, including Spybot Search & Destroy, to download online. Windows Vista actually includes Windows Defender, a free anti-spyware program.

How to remove Trojan

1. If you are using and operating systems such as Windows XP or ME, you MUST disable your System
Restore before attempting any removal! After successful removal, you can re-enable System Restore. Here is how to turn off System Restore:

Log on as Administrator.
Right-click the My Computer icon on the desktop and click Properties.
Click the System Restore tab.
Select Turn off System Restore.
Click Apply > Yes > OK.
Continue with the scan/clean process. Files under the _Restore folder can now be deleted.
Re-enable System Restore by clearing Turn off System Restore.

2. Make absolutely sure you have the latest "paid for" versions of removal tools such as Ad-aware and Spybot Search & Destroy.

3. Reboot your system in "safe mode". Here is how:

• If the computer is running, shut down Windows, and then turn off the power

• Wait 30 seconds, and then turn the computer on.

• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.

• Ensure that the Safe mode option is selected.

• Press Enter. The computer then begins to start in Safe mode.
• When you are finished with all troubleshooting, close all programs and restart the computer as you normally would.

4. In "safe mode", run Ad-aware, and if still needed, Spybot. If you have the "paid for" versions of these products, make sure you install the "add-ons" they have. For example, Ad-Aware has a special add-on to help remove a very nasty Trojan named VX2 (or Transponder).

5. Reboot your system in normal mode and rerun Ad-Aware and Spybot. Hopefully you will get a clean report...

6. Once your get a clean report, use the same System Restore procedure as above, but this time turn System Restore back on.