How does a Trojan Horse virus work?

Answer 1

A "trojan horse" is not a virus; it's a type of malware that may be spread like a virus.

It hides within other programs, or pretends to be a trusted program, but it is really malicious software. Like the Trojan Horse in the Iliad, it secretly does damage once you mistakenly let it into your computer system.

A Trojan Horse is a program that gives a hacker or cracker power over your computer. It usually provides the attacker with unauthorized remote access to a compromised computer, infects files and damages the system, drops other dangerous parasites or steals user sensitive information.

Trojans can be very small in size, as little as 8 kb, and can be hidden inside other executables.

The Trojan is really two programs in one. The first part is called the "client" and is used by the hacker to control the victim's computer. The client is not installed on your computer but on the hacker's. The second part is the "server" and it is installed on your computer. Once executed this "server program" will provide information to the client program upon request. This server program once installed hides itself on your computer and will run automatically every time you start the computer.

First the Trojan must be delivered to your computer. This can be accomplished in many ways, through an e-mail worm, or hidden in another executable program like an mp3 song or a free game or picture. Running the program installs the Trojan on your computer.

How Trojans workTrojans usually consist of two parts, a Client and a Server. The server is run on the victim's machine and listens for connections from a Client used by the attacker.

When the server is run on a machine it will listen on a specific port or multiple ports for connections from a Client. In order for an attacker to connect to the server they must have the IP Address of the computer where the server is being run. Some trojans have the IP Address of the computer they are running on sent to the attacker via email or another form of communication.

Once a connection is made to the server, the client can then send commands to the server; the server will then execute these commands on the victim's machine.

Today, with NAT infrastructure being common, most computers cannot be reached by their external ip address. Therefore many trojans now connect to the computer of the attacker, which has been set up to take the connections, instead of the attacker connecting to his or her victim. This is called a 'reverse-connect' trojan. Many trojans nowadays also bypass many personal firewalls installed on the victim's computer (eg. Poison-Ivy).

One method of virus/trojan control:

1. Run Deckard's System Scanner (DSS)

2. Run the vundo and combo fix

3. Run Malwarebytes Anti-Malware

4. Run the anti spyware removal programs spybot

5 Run Superantispyware

6. Run a complete scan with free curing utility Dr.Web CureIt!