From the Help Desk ...Trojan Horses

1. What is a Trojan horse?
2. What can be done to prevent Trojan horses?

1. What is a Trojan horse?

The term "Trojan horse" originated from a story in Greek mythology.  Two kingdoms went to war over Helen, the most beautiful woman in the world.  Helen was abducted by Paris, a suitor, to the city of Troy and her husband Menelaus decided to attack Troy and claim Helen back. In the war scheme, Menelaus built a large wooden horse which was hollow on the inside so that soldiers could hide in it. The Trojans (the inhabitants of Troy) were tricked to believe that they had won the war and they led into Troy the wooden horse left by Menelaus, which the Trojans thought that it was a gift. That night, while the Trojans were asleep, the Greek warriors came out from the horse and they slaughtered all the Trojans. Troy was destroyed and Helen was claimed back.

In the IT context, a "Trojan horse" means a program (some simply call it "Trojan") that infiltrates your computer and damages or compromises the security of your computer in the same way as a Trojan horse.  Typically, Trojan horses are spread via email, instant messengers or file-sharing tools (e.g. peer-to-peer sharing software, ICQ).

There are many different kinds of Trojan horses depending on what they do.  For example, one Trojan horse comes as a browser plug-in where users are led to believe they are downloading an e-card viewer plug-in for viewing an e-card which they have received, but what gets downloaded is actually a software which serves pop-up advertisements for obtrusive web sites.

Another more serious kind of Trojan horses makes it possible for someone else to access your computer over the Internet.  For example, it may open a port (channel) on your system which can be used by an attacker to connect to your computer. Trojan horses can enable an attacker to view/modify/delete your data, or capture your keystrokes on a keyboard so that he can trace the websites you visit or steal your passwords. Depending on the Trojan horses, there can be many functions built in which can be remotely monitored by an attacker.

The 'Bugbear/Tanatos' worm and the 'Opaserv/Scrup' worm are popular Trojan horses these days - they methodically go from IP address to IP address and scan for open ports at the address.

Some Trojan horses perform port scanning on others on the Internet without your knowing.  If you ever receive a complaint from another person saying that you have been doing port scanning of his PC, and there is a network log to prove that the scanning had come from your IP address, then your PC is most probably infected with a Trojan horse.

In short, Trojan horses are often spread through virus infection or the user is tricked to install some Trojan horse software.  So, don't trust software or documents from unknown sources.

-Back To Top-

2. What can be done to prevent Trojan horses?

A) Perform Anti-virus Live Update Regularly

Remember, it is not good enough just to have an anti-virus program installed on your computer. You must perform live update regularly (recommended daily) in order to get the latest virus definitions, otherwise you are not getting the protection against the latest virus variants.  The latest anti-virus software protects your PC against viruses, Trojan horses and malicious ActiveX code.

To perform live update with Norton AntiVirus or to schedule live update automatically, see http://www.itservices.hku.hk/faq/virus/Norton.html
 

B) Perform Windows Update Regularly

Perform Windows Update when you learn of a critical update is available (and get a habit to check at least monthly). This will download and install the latest Windows security patches.

Click the Windows "Start" button => "Windows Update".  This will invoke the IE browser window at the Microsoft Windows Update homepage. Click the "Product Updates" button at the top left.  At this time, the update program will check your system for any software and security updates you must have on your computer since the last update, and it will put the update in a folder called "Critical Updates and Service Packs". If you see this item selected for you, you must click the "Download" button and update your system accordingly. Other non-critical updates are optional.
 

C) Avoid any software without knowing its source

Do not install or download any software where the source is unknown.  Only download software from trustworthy web sites.  Since it is easy to fake the sender address of an e-mail, if you receive a skeptical e-mail from your colleague or your friend, do not open any attachment or install any attached program.  Ask your colleague or your friend to confirm that they really send you an attachment or a program and ask what it is for.
 

-Back To Top-

Mabel Chau 
Tel: 2859 8934 
E-mail: chaumabc@cc.hku.hk