What is a Trojan?

As the name suggests, a Trojan file is one that appears harmless but contains something unexpected and unpleasant. In most cases this is a program that installs itself on the recipient’s computer and runs in the background without the user being aware of it.

What do the programs do?

Different Trojans perform different tasks, but they are commonly used to collect usernames and passwords or to scan drives for sensitive documents that they forward to the sender of the infected e-mail. Some attacks involve sending basic programs designed to download more sophisticated Trojans once they are installed on the target computer. Others use each computer they infect as a staging post from which to launch further attacks.

Is it possible to recognise a Trojan file?

Senders are getting better at disguising malicious content and an e-mail containing a Trojan may appear to come from a friend or business contact. E-mail users are therefore advised to be suspicious of any unexpected messages, especially those containing an attachment. The types of attachment most commonly used for such attacks are executable programs (which can be recognised by the .exe suffix at the end of the file name) and help files (.chm), but document and database files have also been used. Harmful files may also have been compressed, in which case they would have a .zip or .rar suffix.

Who is most at risk?

Most attacks target people who are likely to have sensitive information on their computers. The latest Trojans have been sent to Government departments and large businesses.

Will antivirus software block Trojan files?

It will help, as long as it has been kept up-to-date with the latest upgrades, but attackers constantly develop new variants designed to slip through the net. Since there is a time-lag between a new strain emerging and the development of a patch to counter it, antivirus software can never offer complete protection.

Will a firewall prevent sensitive files being sent from the recipient’s computer?

Not necessarily. Many Trojans use the standard internet access port for communicating with the attackers, so any firewall that allows a connection to the internet will allow these programs to send data from the recipient’s computer.

Is it possible to tell whether a computer is running a Trojan?

Any computer that seems to be running slowly for no apparent reason should be investigated, in case the slowdown has been caused by a Trojan draining computing power as it scans disks or sends data. Users suspecting an attack are advised to check whether the computer has accessed the internet out of working hours, or whether there have been any unexpected data transfers.

Can Trojans be removed?

Yes, but it can be difficult because the programs often bury themselves deep within the computer's operating system. Software is available that claims to detect and the remove the files, but users are recommended to seek the help of an IT expert if they suspect a computer is running a Trojan.

Times Recommends

• Minister in talks with Saudis to protect creditors
• Premier Inn hits back in £29-a-room row
• Bankers hit back at 'populist' bonus supertax