In history, a Trojan horse was a large wooden horse
that was used by the Greeks to capture Troy from the Trojans.
In our computers, there is a digital version
of this Trojan horse used by attackers
to be able to sneak their software onto your system.
This Trojan horse software is software
that pretends to be something else
and it looks like software that is perfectly normal.
You may think you're installing a spreadsheet, an imaging
editing program, or a game.
But in reality, you're installing malware that's only
pretending to be that software.
Trojan horse software is not only
designed to look innocuous to you,
it's also designed to look non-threatening
to your antivirus software.
And very commonly, Trojan horse software
can get onto your system, disable all your security
tools, and then have free reign of your computer.
Now that the Trojan horse is running,
it can configure back doors or download additional malware
to install on your system.
One type of software that's commonly
downloaded by this Trojan horse software is a PUP.
This is a potentially unwanted program.
This may not be malicious software,
but it could be undesirable and may cause performance problems
on your computer.
For example, it might install a browser toolbar
that becomes very difficult to uninstall or remove
from your browser.
Or it may be a backup utility that
constantly shows advertising even when it's not backing up.
Or it might be software that hijacks your browser,
and every time you try to search something in Google,
it redirects you to a different search engine.
Here's a list of potentially unwanted programs
that I found on one of my very infected Windows systems.
And it's a mixture of software that's
designed for backups, looks like there is a download process
and a toolbar that's installed.
And these potentially unwanted programs
with names like Conduit, MyPC Backup, Spigot, and Mobo Genie
were very easily found by my anti-malware software.
We mentioned earlier that when malware finds itself a way
to run on your computer, one of the things that it tends to do
is to open up a back door on your system.
That's because it's very, very difficult
to find vulnerabilities and to get
users to click on these links.
And once malware is running, it wants
to find a way to easily reconnect to your system
later on without having to go through that very
difficult process again.
To be able to do that, it starts up
some new software on your computer
that opens a back door.
This would be very similar to the back door of your house.
The malware simply creates a new way to get into your system
without having to go through the front door.
What's interesting about some of these back doors
is that the same backdoor process can be used
by multiple types of malware.
So once one type of malware gets onto your system,
other types of malware are able to get into and infect
your computer through that same back door that
was created originally.
You might even find that software or hardware that you
thought was secure may also include
a backdoor into its code.
For example, very old versions of Linux
had a back door that was built into the kernel.
And you might also find that applications
and other equipment that's connected to your network
might inadvertently include back doors
as part of the software that's running on those systems.
A type of software that attackers
might install as part of the back door
is a Remote Access Trojan, or a RAT.
You might also hear this referred to as a Remote
Administration Tool.
This is a remote access tool that gives a third party access
to your computer to have nearly complete control
over the operating system.
The malware that gets installed onto a computer
might install this Remote Access Trojan.
And from that point on, the third party
is able to access your computer remotely
and control many aspects of what the operating system is doing.
It can collect a log of all the keys you press,
including your usernames and passwords.
It might record the screen or take screenshots and transfer
those back to the attacker.
It can copy files, either from your computer
or to your computer.
And of course, it can then run and embed
more malware on your system.
This is a screenshot from the attackers perspective who's
taking advantage of a system that's infected
with the DarkComet RAT.
And you can see this graphical administration
frontend allows the attacker to perform
many different functions.
They can change the configurations of the registry.
They can run scripts.
They can transfer files or even restart the computer,
all from this graphical administration frontend.
The process of preventing a Trojan or RAT
from running on your system is very similar to preventing
any other type of malware.
You don't want to click any unknown links or links
inside of your emails.
You always want to be sure that your antivirus software is
running and that you have the latest signatures installed
for that software.
It's always good to have a backup
so that if a system does become infected
and you're not able to remove that software,
you can easily restore your system from that
known good backup.