Trojan Virus:

Ok not sure if you all know what one is or does so heres a brief rundown ...

A Trojan is basically a server that is created with the only function of taking control of your PC,
the creator can do such things as:

Switch on your webcam.
Listen to Audio coming from your room.
Watch everything you do on the internet (same as a remote desktop would).
Open web pages and force your browser to visit there.
Steal your passwords (yes ALL passwords and Login information like MSN/Paypal/Credit Card etc etc etc).
Open a chat window to the victim (used either for fun/annoyances/blackmail).
Send fake windows popup messages.
Use your PC to hack others with.
Uninstall programs including your Anti Virus etc.
Take over your Mouse and Keyboard.
Look through your personal photos/files and download them or share with others at leisure.
Destroy your PC.
Upload and download to and from your PC.
Use your PC (and others) to perform a DDOS attack on a person or website, the more victims they have the more powerful their attack is, usually used for annoyance/knocking someone offline they dont like/blackmailing a website owner/political cyber terrorism. You dont want a knock at your door from some official asking why your "attacking" a certain website or person im sure, this type of virus is usually from a Botnet (part of a large network of victims controlled by 1 or more persons).

And a plethora of other things, none of which you want happening to you!

How to avoid getting one ...

Most Trojans will come via Torrent sites etc and are actually binded to legitimate files which still function properly, the virus can also be encrypted to hide from your Anti-Virus software, your Anti-Virus is actually a few weeks behind encrypted Trojans so this gives the hacker/s a good head start until their signature is detected by which time theyve already made a new encrypted version and the process goes on, once you have one of these viruses it is easy for the creator to update his server on your PC as he already has full access to it.

Avoid Keygens - these are the most common ones they use for binding their Trojan.

If you must download a program use the official website for it and no other.

Viruses can be binded to any .exe file, .MP3 and .AVI would not be affected by this as it would render the MP3/AVI unusable (currently).

Also be aware of one called a Java Drive-by, this is basically a link that opens a Java window and says you need to update your Java - and of course your actually installing the Trojan, just close the window and avoid these type in future.


What to look for on your PC:

If you think you have a Trojan virus open your task manager and look at what programs are running, a lot will emulate legit Windows processes like WINLOGON.EXE so if you see 2 of these running them you have a virus, of course they will use other names too like SVCHOST.exe or you may even just see something like 24578.exe or some other random name, they try to disguise them, some are actually injected into EXPLORER.EXE, so as you can see detection can be hard sometimes, if you notice strange things happening like weird popup messages or your mouse moving etc then its a good guess you have one, some hackers will just watch what you do, others can be destructive or steal your information and even sell it on to other hackers, including things like your STEAM account/Paypal etc etc. If you have friends that tell you you are emailling them strange links and you know it isnt you then this is from a Botnet type virus, it (and other types) will use your emails and contact list to try and spread their virus link to all your contacts, some do it automatically (Worm type) and some manually by the creator.

A Trojan is also referred to as a RAT (Remote Admin Tool), this is the software that connects to the virus and they use it to perform the above functions.

If you find you cant access task manager or it seems blocked then theres a good chance you already have a Trojan as they can disable it to stop you trying to remove it although this is a dead giveaway that you have one, system restore can also be disabled, if this is the case then i would suggest a format and a full reinstall of your operating system as locating it/them can be tricky.

Yes -you can have a lot more than one RAT on your PC - infact they usually sell "installs" - this is a person selling someone access to your PC by installing the buyers server alongside their own, the cost? about 50cents per person! Your as cheap as that to them. Infact i must stress that they value your life at 50cents in some cases because with this access to your PC they can basically destroy a persons life if they were that way inclined.


Some steps ...

check your startup,
Open regedit and go to directory:
Hkey_Current_User/Software/Microsoft/Windows/CurrentVersion/Run
In this directory you will see the programs that run on startup,
Check to see if there are any weird names, if there are Copy the
DATA value and delete the Registry startup key, then go to your
Documents and put the Data, in the adress bar it will take you
to where the "RAT" or unfamiliar object is, Virus scan this object
or if you know its a rat delete it.

If you are unsure of any running processes just google it (example- blah.exe) and youll find queries from other people, dont rush in deleting things though - check things out thoroughly and look at the spelling and the paths carefully.


Do download Malware Bytes (from the official site), its free and finds a lot of Trojans that you would expect your expensive Anti-Virus software to find.

Official site ...

http://www.malwarebytes.org/

Hope this helps you all and makes you aware of the threat from them, if you are still unsure then just give me a shout

ps - If you have a webcam - unplug it unless your actually using it or you may (or may not) find your being watched, this is especially important if you have kids that use them, educate them and make them safe.


AVOID KATZ FORUMS its just a nasty hive of thousands of binded viruses!

Website owners: Do fix your sql errors as this gives hackers a backdoor into your website with brute force attacks to get your login and password, usually used to deface your website or totally destroy it or steal members information etc etc

Good to see you posting again Rob, and excellent, authorative
and easy to understand information and a great source for
anyone not 100% sure about trojans (including me). This should
be a sticky at the top of the page.

Hey good to see you again too Lee

Ive studied a lot of what goes on in the hackers world and it really is shocking, ive briefly touched up on it here as i would not like to see any of you good guys fall victim to one of these nasties.

I could go more indepth with them and other things but for your own safety what you need to be wary of is here, should you require anymore help/advice im here to help

Another thing to note - on Youtube be VERY WARY about clicking any links the owner has posted in the video comments, ive seen links on some that lead directly to a fake program (just a Trojan virus renamed and an icon added).

I currently run Norton Antivirus and Malware Bytes and some other stuff but i rarely download things now and i always check my running processes, im not trying to cause any panic - merely trying to make people more security conscious

hi Rob, great info - many thanks for posting this up.

Hi Paul,

Your very welcome m8

The Admiral is back one day and he's already looking out for us!

Awesome guide Rob and after talking to you in chat about those webcam watchers I think its all very scary

Heed the warning guys - don't download things you don't trust!

Someones gotta watch your ass Joe (yeh ill give Jimmy some time off from it his eyes must be sore by now )

Ive updated it a little more to help

FUCK!!! My whole hard drive has been wiped out. Everything - all my documents, pictures, music, work stuff, important stuff, all of it! I shut my computer down at the end of the day like normal and when I started it back up tonight it started in windows XP like it is a brand new computer!

Someone please, PLEASE, tell me there is a way to restore my computer to what it was. Any help would be so appreciated right now!

Disregard - it somehow magically fixed itself with a simple restart.