What is a trojan?
A trojan, named after the Trojan horse, gets in through deception rather than self-spreading code. The user installs or runs it on purpose, believing it is something they want: a free utility, cracked software, a game mod, a fake browser update or an email attachment posing as an invoice. Once it runs, it has the same permissions as the user, and it delivers a hidden payload while sometimes still doing the job it advertised so nothing looks wrong.
What trojans do
- Open a backdoor so the attacker can reconnect later without the user's help.
- Install a remote access trojan (RAT) that gives the attacker remote control of files, screen, keystrokes and sometimes the webcam.
- Act as a dropper or downloader that fetches other malware, such as ransomware, spyware or a cryptominer.
- Steal credentials, for example banking trojans and infostealers that harvest saved browser passwords and session cookies.
- Join the device to a botnet used for spam or denial-of-service attacks.
Phones are targets too. Trojanized apps from unofficial sources, such as an APK sent in a text message, often ask for Accessibility, SMS or device administrator access right away.
Signs of a trojan
Symptoms usually come from the payload rather than the trojan itself:
- New programs, startup items, services or scheduled tasks nobody recognizes
- Constant outbound connections to unfamiliar addresses, even when the device is idle
- Mouse or windows moving on their own (remote control)
- Antivirus or firewall turned off, or new local administrator accounts
- Unexpected MFA prompts, password reset emails or sign-ins from unknown locations
Prevention
- Install software only from the vendor's site, an official app store or the company portal; avoid cracked software and "premium for free" offers.
- Check the publisher and digital signature. Treat an "Unknown publisher" UAC prompt or a SmartScreen warning as a reason to stop.
- Compare the file hash with the one the vendor publishes for important downloads.
- Use standard user accounts so installers need admin approval, and application allow lists where possible.
- Keep antivirus current, keep Office macros disabled by default and treat unexpected attachments as untrusted.
Removal
Disconnect the device from the network first, because a RAT gives the attacker live access. Scan with updated anti-malware, including an offline scan if the trojan interferes with Windows. Since trojans often install other malware and persistence, reimaging is the safer choice when you cannot be sure the system is clean. Then change passwords from a known-clean device, starting with admin and email accounts, and review MFA methods and trusted devices for anything the attacker added.
Trojan vs. virus vs. worm
- Trojan: standalone program, disguised as something legitimate, does not replicate; spreads only when people install it.
- Virus: attaches to a host file or boot area and copies itself when the host runs.
- Worm: standalone program that copies itself across a network without user action.
Trojan on the CompTIA A+ exam
Trojans are among the malware types in Core 2 (220-1202) objective 2.4. The key word is disguise: if the malware "appeared to be a legitimate program" or arrived as free or cracked software, think trojan. If an attacker now controls the PC remotely after the user installed a free game, think remote access trojan. If the malware spreads by itself across the network, the answer is a worm, not a trojan. For remediation questions, expect isolation, scanning, often a reimage, and password changes from a clean device.