Trojan Horse
A trojan horse is a computer program that appears to have a useful function but also has a hidden and potentially malicious function. It does not replicate itself, and its hidden code runs when the program is invoked.
Updated
Overview
A trojan is disguised as legitimate software. Once it runs, it either replaces existing files with malicious versions or adds new malicious files to the host, and it often delivers other attacker tools such as keystroke loggers and rootkits. Its hidden function can evade security mechanisms, sometimes by exploiting the legitimate authorizations of the user or process that runs it.
Trojan horses are one of the classic malware categories, alongside viruses and worms. Many instances of malware today are blended attacks that combine several infection or transmission methods, so NIST advises organizations not to spend substantial time and resources assigning each incident to a category.
Host-based intrusion prevention products that monitor attempted changes to files can detect trojans trying to replace files. A trojan tends to affect a single host, so NIST bases the response on the value of the data and services that host provides. For more damaging incidents, such as those involving trojans, rootkits, or backdoors, it is often best to rebuild the host first and then secure it so it is no longer vulnerable.
Similar Terms
2 termsComputer Virus
A virus replicates by inserting copies of itself into host programs or data files. A trojan horse does not replicate. It is a self-contained program that appears benign while hiding a malicious purpose.
Computer Worm
A worm copies itself to other hosts across a network, usually without user intervention. A trojan horse does not spread by itself; its hidden code runs when someone invokes the program.
Frequently Asked Questions
Is a trojan horse a virus?→
NIST lists them as separate malware categories. A virus self-replicates by inserting copies of itself into host programs or data files, while a trojan horse is a nonreplicating program that appears benign but has a hidden malicious purpose.
What does a trojan horse do?→
It carries out a hidden malicious function alongside its apparent useful one. Trojans replace existing files with malicious versions or add new malicious files, and they often install other attacker tools such as keystroke loggers and rootkits.
How do you remove a trojan horse?→
When a trojan has replaced system files, NIST recommends rebuilding the host instead of performing typical eradication actions such as disinfection, then securing the host so it is no longer vulnerable to the same malware.
Related
Tool categories
Career roles
Glossary terms
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.