What is a danger of having your computer infected with Trojan?
What is a Trojan horse?
In the IT world, a Trojan horse is used to enter a victim’s computer undetected, granting the attacker unrestricted access to the data stored on that computer and causing great damage to the victim. A Trojan can be a hidden program that runs on your computer without your knowledge, or it can be ‘wrapped’ into a legitimate program meaning that this program may therefore have hidden functions that you are not aware of.
In the IT world, a Trojan horse is used to enter a victim’s computer undetected, granting the attacker unrestricted access to the data stored on that computer and causing great damage to the victim. A Trojan can be a hidden program that runs on your computer without your knowledge, or it can be ‘wrapped’ into a legitimate program meaning that this program may therefore have hidden functions that you are not aware of.
How a Trojan works
Trojans typically consist of two parts, a client part and a server part. When a victim (unknowingly) runs a Trojan server on his machine, the attacker then uses the client part of that Trojan to connect to the server module and start using the Trojan. The protocol usually used for communications is TCP, but some Trojans' functions use other protocols, such as UDP, as well. When a Trojan server runs on a victim’s computer, it (usually) tries to hide somewhere on the computer; it then starts listening for incoming connections from the attacker on one or more ports, and attempts to modify the registry and/or use some other auto-starting method.
Trojans typically consist of two parts, a client part and a server part. When a victim (unknowingly) runs a Trojan server on his machine, the attacker then uses the client part of that Trojan to connect to the server module and start using the Trojan. The protocol usually used for communications is TCP, but some Trojans' functions use other protocols, such as UDP, as well. When a Trojan server runs on a victim’s computer, it (usually) tries to hide somewhere on the computer; it then starts listening for incoming connections from the attacker on one or more ports, and attempts to modify the registry and/or use some other auto-starting method.
It is necessary for the attacker to know the victim’s IP address to connect to his/her machine. Many Trojans include the ability to mail the victim’s IP and/or message the attacker via ICQ or IRC. This system is used when the victim has a dynamic IP, that is, every time he connects to the Internet, he is assigned a different IP (most dial-up users have this). ADSL users have static IPs, meaning that in this case, the infected IP is always known to the attacker; this makes it considerably easier for an attacker to connect to your machine.
Most Trojans use an auto-starting method that allows them to restart and grant an attacker access to your machine even when you shut down your computer. Trojan writers are constantly on the hunt for new auto-starting methods and other such tricks, making it hard to keep up with their new discoveries in this area. As a rule, attackers start by “joining” the Trojan to some executable file that you use very often, such as explorer.exe, and then proceed to use known methods to modify system files or the Windows Registry.
How can I get infected by a Trojan?
Trojans can be embedded in any executable file. The critical thing here is that the file must be executed to install the Trojan on your computer. Trojans can be sent via e-mail, ICQ, mIRC or IRCLE, FTP, Freeware or Shareware programs, mp3 and even movies. Some Trojans can even turn your webcam on so that the hackers can get a good look at your face.
Protecting Your Computer
To protect your computer from Trojans you need to get yourself a high quality virus scanner. You should also make sure you install a firewall as this will prevent hackers from accessing your computer in the first place.
Also use your common sense and make sure you're very careful whenever you're downloading anything from the internet. Never download anything unless you trust it, and make sure that it's from a trusted source. Also avoid downloading anything illegally as these often include some nasty extras.
Trojans Listing
If you have suspicion that you are infected by Trojan, run the anti-Trojan utilities (review the free software section). Be sure not to limit your “cleaning” with a single utility, but run several of them one after another. For less experienced users, there is not much difference, what your Trojan is suppose to do on your PC, and through which port it has entered the computer. The programs will do the dirty job without need of the user’s input.
However, if you consider yourself as pretty much computer literate, you may want to investigate the intrusion more seriously, checking and closing the security gap. For those, I would recommend review the listing of Trojans, filtered by different categories, like name, country of origin, actions, affected systems, ports, etc. Review the list: http://www.simovits.com/trojans/trojans.html
Sources and Additional Information:
Posts
