Malicious code (malware): trojan

The idea

A trojan (trojan horse) is malware disguised as legitimate, useful software so that a user is tricked into installing and running it. Unlike a virus it does not need to attach to another file, and unlike a worm it does not self-replicate; the user installs it willingly because it appears genuine, for example a fake game, toolbar or 'free' utility. Once running, it can open a backdoor for an attacker, steal data, download further malware or give remote control of the device. The defining feature for the exam is deception: the harm comes from the user being misled into trusting the program. When answering, identify the disguise as legitimate software, the user's voluntary installation, the absence of self-replication, and a possible harmful action such as data theft or remote access.

What earns the marks

• A trojan is malware disguised as legitimate or useful software.
• The user is tricked into installing and running it, so it relies on deception rather than self-replication.
• Once active it may open a backdoor, steal data, download further malware or allow remote control.
• Its defining feature is the disguise that persuades the user to trust and install it.

Common mistakes and how to put them right

• Describing a trojan as a program that copies itself into other files.

  Put it right: That is a virus; a trojan relies on the user installing it.

• Saying a trojan spreads automatically across a network.

  Put it right: It does not self-replicate; the user is tricked into installing it.

• Assuming a trojan is harmless because it looks legitimate.

  Put it right: The disguise hides harmful actions such as data theft or remote access.

Exam tips

• Look for the idea of disguise or pretending to be genuine software; that identifies a trojan.
• Reject options describing self-replication or attachment to a host file, which fit a virus or worm.
• Tie the trojan to a consequence such as a backdoor or stolen data to confirm the choice.