Trojan horse

This article is about computer programs, for the mythical siege machine see Trojan Horse

In the computer world, a Trojan horse is a relatively dangerous computer program that does something which the programmer (or a packager, distributor, advertiser) maliciously intends it to do, but which is unknown to the user. The term is derived from the classical myth of the Trojan Horse.

A Trojan horse differs from a virus in that it is a stand-alone program; the Trojan does not attach to another program. It differs from a worm in that it does not move from one computer to another on its own. A person must transfer it intentionally, such as by email.

For example, on the Microsoft Windows platform, an attacker might email a Trojan with an innocuous filename, attached to an email message that claims the program does something useful. The Trojan may really perform what it advertizes to the user, in addition to the malicious payload to keep the user unaware of its true intentions. When the user executes the attachment, the malicious program executes with the same permissions of the user, and it can thus modify or delete files, or change the configuration of attacked machine. Newer Trojans also access networks, sometimes attacking them by flooding them with messages.

Typically, a Trojan horse is an executable code contained in e-mail attachments, usually in the form of a binary file, such as an .exe, .scr, .bat, .pif and other pretended formats in the Windows environment. These extensions might be "masked" behind false or additional extensions that do not look like executables to a user. In the Unix world, a Trojan has to be intentionally executed, thus it is more likely that it will advertize itself as a useful program.

A prototypical Trojan horse is, for instance, a program called "SEXY.EXE" that is posted somewhere with a promise of "hot pix", but when executed erases all the files it can find and prints the message "arf, arf, I got you!".

It is prudent to not open attachements that you do not expect. It is always a good idea to scan e-mail attachments with updated antivirus software before opening them, or to make sure of the originating source of the programs you execute. A typical Trojan does not infect other programs and is usually easily deleted, but its true purpose may vary.

An early Trojan horse was the 1975 ANIMAL program, a game to identify an animal but which also spread itself to other users on UNIVAC Exec 8 computers[1].

See also

• secure computing

Referenced By