In this article I will try to explain, hopefully in terms everyone can understand, exactly what a trojan horse is, how to tell if you've been infected, and how to get rid of it.A "trojan horse" (Coined by MIT-hacker-turned-NSA-spook Dan Edwards)is a malicious, security-breaking program that is disguised as something benign, such as a directory lister, archiver, game, or (in one notorious 1990 case on the Mac) a program to find and destroy viruses! The most widespread at the moment is Back Orifice (BO).
BO is in essence a "remote administration tool" This means if BO is running on your system, a remote user anywhere on the internet can gain access and do almost anything on YOUR computer that you yourself can do. BO can arrive disguised as a component of practically any software installation. It can be attached to other files or programs or run on its own. It must be run, by itself or by another application. It then installs itself in seconds, typically erases the original, then may run a specified program. To the user installing an "infected" application, it will appear that all went normally. But from that moment forward, your system offers easy and comprehensive access anytime it is connected to the Internet. In itself, BO does not cause any malfunction. It runs quite invisibly to the user, consumes insignificant memory and resources, and does little besides simply open up access to standard Windows 95 functions.
The best way to detect and clean (if necessary) your system of BO is to download BODetect - a program written specifically for this purpose by Chris Benson, who works for Symantec. I personally have tested this program, and it works great.
In conclusion, the best way to avoid trojan horses altogether is to check the files you download or receive via email and make sure you know what they are and who they came from. Most virus scanners cannot detect Back Orifice yet, so you must be extra vigilant.
 
|
