On Trojans and Horses

Last year, a lot of computer users suffered from the effects of viruses, worms and other forms of computer "malware". These mischief makers have grown more sophisticated each year, making use of email, networks and the Internet to spread their malicious kind, exploiting vulnerabilities and loopholes in computer system software. We've discussed worms and viruses before. Let us now look at one other form which could possibly wreak more havoc in the coming months, the TROJAN HORSE. Here is some information about them from the IRCHelp.org website.

I. What is a Trojan horse?

Many people use terms like Trojan horse, virus, worm and hacking all interchangeably, but they really don't mean the same thing. Let's just say that once you are "infected", Trojans are just as dangerous as viruses and can spread to hurt others just as easily! Named after the legendary exploit used by the Greeks to conquer the city of Troy, these little buggers are not what they appear to be.

In today's computer world, a Trojan horse is a "malicious, security-breaking program disguised as something benign" such as a screen saver, game, or attack. The most (in)famous Trojan horse was the "LoveBug" in May 2000. When this "love letter" was opened, it caused a lot of mischief, such as sending itself out to everyone on your email address book or IRC channel, erasing or modifying your files, and downloading another Trojan designed to STEAL YOUR PASSWORDS. Many Trojan horses also allow crackers (aka "hackers") to take over and "remote control" your computer.

II. How did I get infected?

Trojans can spread disguised as ANYTHING people find desirable, such as a free game, picture, mp3 song, etc. You probably downloaded the Trojan from a WWW or FTP archive, ICQ file exchange, or through IR Chat DCC file transfer (manually or, worse yet, an "auto DCC get" feature). Typically you must trigger/run the Trojan program on your computer. You may have known it was an executable but thought it was something else, been fooled by a hidden file extension, or just gotten careless and clicked on it. Trojans usually do their damage silently in your disk or network. The first sign of trouble is often when others tell you that you are trying to send them some Trojan!

III. How do I avoid getting infected in the future?

You must be certain of BOTH the source AND content of each file you download! In other words, you need to be sure that you trust not only the person or file server that gave you the file, but also the contents of the file itself.

Here are some practical tips to avoid getting infected (again).

  1. Never download from people or sites you aren't 100% sure about. If you download commercial games or other software from unauthorized sources, you are not only breaking copyright laws, eventually, you will fall victim to a Trojan.

  2. Even if the file comes from a friend, you still must be sure what the file is before opening it (as Melissa and the LoveBug proved). Remember, just opening a Trojan (by double clicking, previewing, etc.) unleashes its damage. When in doubt, ask first.

  3. Beware of hidden file extensions! Windows, by default, hides the last extension of a file, so that innocuous-looking picture "susie.jpg" might really be "susie.jpg.exe" - an executable Trojan! To avoid being tricked, unhide those pesky extensions.

  4. Never use features in your programs that automatically download or preview files. Those features may seem convenient, but they allow anybody to send you anything, not just dangerous Trojans, worms and viruses but also pornography, huge files to fill your disk, etc. For example, never turn on "auto DCC get" in mIRC, instead ALWAYS screen every single file you get manually. Likewise, disable the preview mode in Outlook and other mail programs.

  5. Never blindly type commands that others tell you to, or run pre-fabricated programs or scripts (not even popular ones). If you do so, you are trusting a stranger with control over your computer, which can potentially lead to Trojan infection or other serious harm.

  6. Don't be lulled into a false sense of security just because you run anti-virus programs, which do not protect perfectly against many viruses and Trojans. Anti-virus programs should not be your front line of security, but instead they serve as a backup in case something evil sneaks onto your computer.

  7. Finally, don't download an executable program just to "check it out" - if it's a Trojan, the first time you run it, you're already infected!

IV. How do I get rid of Trojans?

  1. Clean Re-installation: Although arduous, this will always be the only sure way to eradicate a Trojan. Back up your entire hard disk, reformat the disk, re-install the operating system and all your applications from original CDs, and finally, if you're certain they are not infected, restore your user files from the backup. If you are not up to the task, you can pay a professional repair service to do it for you.

  2. Commercial Anti-Virus Software: These can handle many of the better known Trojans. You MUST make sure you have the very latest updated signature files for your programs, or else they will miss the latest Trojans. Even when fully updated, anti-virus programs are never perfect, if they fail to find every Trojan, anti-virus software can give you a false sense of security, not realizing that you are still compromised. Some decent products include: www.avp.com, www.norton.com ,and www.mcafee.com . Most are available for immediate downloading with 30-day free trials.

  3. IRC Help Channels: If you're the type that needs some hand-holding, you can find Trojan/virus removal help on IRChat, such as #dmsetup or #HackFix on EFnet. These experts will try to figure out which Trojan(s) you have and offer you advice on how to fix it, such as by using their own anti-Trojan scripts.

  4. WWW Help Sites: For the do-it-yourselfers, just about every Trojan with a known fix is cataloged at the www.hackfix.org, which is the home page for EFnet #hackfix, with a partial list at http://www.irchelp.org/irchelp/security/trojanfix.html . There's so much information at these sites, however, it may be hard to find a specific fix unless you already know the name of your specific Trojan. In some cases, that is just the name of the file that others are accusing you of distributing by email/IRC/whatever. Unfortunately, the newer Trojans are much more damaging and there are often no easy ways to fix them.

 For more information, see: http://www.irchelp.org/irchelp/security/trojan.html

-oOo-