A Closer Look at Malicious Trojans

Part of iolo’s ongoing series exposing malicious software

With iolo’s Security Spotlight series, you can read about the various malicious programs that infect computers, destroy data, and steal personal information, and get some valuable pointers on how to protect yourself.

Knowledge is power—knowing more about what the high-tech vandals are up to can give you a powerful defense against their tactics.

This part of the series takes a closer look at one particularly insidious type of malware often used in identify theft schemes, trojans.

What is a trojan?

Trojans are programs that appear to be useful, but they intentionally run malicious and destructive functions. Unlike viruses, trojans are not designed to make copies of themselves and spread to other users, but trojans can carry viruses and other malware within them.

A little history
The term “Trojan horse” was created to describe programs that appeared useful but were not what they seemed—the name is based on a story from Greek mythology where soldiers, hiding inside of a wooden Trojan horse, were able to sneak into Troy and conquer the city.

Trojan horses, now often referred to as “trojans” for short, have been around since at least the 1970s—Pervading Animal, a trojan that disguised itself as a guessing game, appeared in 1975 and is considered to be the first trojan.

Trojans of today
While trojans predate the internet (early trojans were distributed on 3.5″ floppies), the advent of the web led to an explosion in the number of trojans being created and distributed. Criminals now take advantage of the internet’s widespread use to lure us into installing trojans—free web downloads and social networking sites are the popular targets of today.

Some infamous trojans

• In 1992 a group of students at Cornell University released Tetriscycle, a trojan masquerading as a computer game. This trojan, combined with other malware they distributed, disabled computers worldwide. Ten days after the attack, the students were found, arrested, and faced felony charges of computer tampering.

• NetBus, SubSeven, and Back Orifice are current, well-known trojans that allow hackers to remotely control computers (more on these destructive remote-access trojans is below). In 1999 NetBus was used to plant illicit files on the computer of a university professor; he lost his job and was facing criminal charges until the NetBus infiltration was discovered.

Where do trojans come from?

Trojans can come from many places: web downloads, email attachments, CDs—all the same ways that you get legitimate programs. Unfortunately, it’s easy to be tricked into installing a trojan because it looks like the program will serve a beneficial and valid purpose. And because of the stealthy code built into their design, trojans can also attach themselves to legitimate programs, and the software developers themselves aren’t aware of it.

What do trojans do?

The effects of trojans can range from persistently annoying to permanently devastating. Users have reported everything from the constant display of ads, to the theft of their banking information, to the destruction of every file on their computer. Two particularly damaging types of trojans are:

• Remote-access trojans (RATs). These trojans give someone total control over your computer. With a RAT, a criminal can open, read, and change everything on your computer: financial data, private letters and photos, personal calendar appointments—you’re now vulnerable to identity theft, robbery, and all kinds of criminal activity. Imposters can also irreparably damage your reputation: installing documents that aren’t yours, sending bogus email messages that look like they’re from you, or using your PC to attack and infect others.
• Ultra-destructive trojans. These trojans are on a mission to destroy and delete. Ultra-destructive trojans can erase every single one of your applications and documents—a complete loss of data that can be impossible to recover from—or they can delete all the core files needed by the operating system, making your PC totally unusable and inoperable; the computer that you rely on is now just a useless piece of furniture.

How you can protect yourself

• Only download trusted programs. Only download programs from web sites that you trust, or check a reputable source for information before you download. Just a few minutes of research can save you hours of heartache.

• Be wary of free programs. Some disreputable sites offer free tools, such as web browser toolbars and screen savers, that are created with the sole intent of hiding trojans. Be particularly cautious when downloading free programs from unknown sources.

• Use anti-malware software. Even with the most diligent preventative measures, malware can still find its way onto your computer: this is particularly true with trojans because they can attach themselves to valid applications. The best bet is to keep your anti-malware software up-to-date and run scans regularly—especially after you install new programs or download files.

How System Shield® can protect you

iolo’s System Shield® protects your PC from all types of malicious files: trojans as well as dozens of other types of malware. Some highlights of System Shield:

		Flexible options for scans		System Shield’s malware scans can run automatically when your computer isn’t being used—you don’t have to think about it—and you also can run scans whenever you want to: a smart choice for after you download files.
		Automated protection 2 ways		For total peace of mind, System Shield offers two automated protection features: Real-time is an invisible form of protection that runs quietly behind-the-scenes to check files as they’re opened, changed, moved, copied, and saved—a critical defense against malware silently making changes to your PC. Email protection automatically scans email messages and attachments before they’re received or sent—both you and the people you communicate with are protected.
		Safe quarantine		System Shield’s Quarantine is a safe holding area that gives you total control over suspicious files. The Quarantine prevents infections from causing any damage, but still allows you to keep the files you know are safe.
		Up-to-date malware definitions		Old definition files can’t protect you against the most recent attacks—and the criminals come up with newly designed malware every day. System Shield updates its definitions in real-time as threats emerge, sometimes even 8-10 times in a single day, based on the latest research from iolo Labs.