subject: How Trojan Virus Run [print this page] In view of the harm of the Trojan horse, many people still have certain knowledge to Trojan horse understand that this to the spread of Trojan played a certain inhibition, this is Trojan designers would be unwilling to meet, so they developed a variety of functions to disguise the Trojan horse, to reduce the user to alert, cheat users ,remove trojan purposes.
(a) modify icon
When you in the E-mail attachments to see the icon, would think this is a text file? But I have to accuse lawsuit you, it could be a Trojan horse program, now has a Trojan can will the program icon Trojan service to HTML, TXT, ZIP, etc all kinds of documents icon, this is very big fan and confused sex, but currently provide the function of Trojan horse are rare, and the camouflage is not perfect, so don't fear all day, so paranoid.
(2) bound files
This kind of false
Hackers use Trojan virus steal net silver
Pack means is tied into a Trojan horse will install procedure, when the installation program is running, Trojan in the user without noticing it and slipped into the system. As for tied to a file is generally executable file (i.e., COM kind of file EXE).
(3) error display
Have some knowledge of the Trojan people know, if a file open, without any response, this is probably is a Trojan horse program, Trojan designers also noticed the defect, so have the Trojan horse provides a show called the function of the error. When the server the user to open the trojans, will pop up an error message box (of course this is false), errors can be free definition content, most will be made for some such as "file has already destroyed, can't open!" The information such as service end users to believe is really true, Trojan yet secretly hacked into the system.
(4) custom port
Many old Trojan ports are fixed, this to judge whether infected Trojan brought convenient, as long as the check specific port will know that infected what trojans, so now a lot of new Trojan joined customization of the port function, the user can control in the 1024-65535 between choose a port as trojans port (generally don't choose below 1024 port), thus to judge by the infection Trojan type to trouble with.
(5) self destruction
this
Limit the spread of Trojan virus
A function is in order to make up the Trojan horse a defect. We know that when the server users open the file containing a Trojan, Trojan will copy to the WINDOWS system folder (C: WINDOWS or C: WINDOWSSYSTEM directory), generally speaking the original Trojan files and folders system the Trojan horse file size is the same (bound Trojan files except), so in the Trojan friends as long as in the recent letters and received download software to find the original Trojan files, and then according to the size of the original Trojan horse to system folders for same size of the file, which is judge the Trojan horse will do. And the self destruction of function is Trojan horse to finish installing Trojan, the Trojan horse will be destroyed, such service end users it can be difficult to find the source of the Trojan horse, without killing the work of Trojan horse in a help, it's hard to remove the Trojan horse.
(6) renamed the Trojan horse
Installation to the system folder names of the Trojan horse general is fixed, so as long as according to some killing Trojan of the article, according to the figure in the system folder search certain files, it can be concluded that what the Trojan horse. So there are many trojans are allowed to control system end users freedom after the custom installation of Trojan filename, so it is difficult to judge by the infection of Trojan type.
