untangling_the_web

DOCID: 4046925
UNCLASSIFIEDliFOR OFFICIAL ~SE ONLY
"low" threat, it is significant because it marks the first time that malware has
successfully infected both mobile devices and Windows-based cornputers.i?"
Trojans are hard to detect because they often use what are called "binder programs"
to link them with a legitimate program so that the Trojan will execute in the
background at the same time that the legitimate program runs, making the Trojan
invisible to the victim.
How can you tell if you have a Trojan on your computer? Some of the telltale signs
are unexplained slow performance, a CD tray that mysteriously opens and closes
randomly, inexplicable error messages, strange screen images, or the computer
automatically rebooting itself. These are by no means the only symptoms and, in
fact, there may be no symptoms at all.
Once the Trojan has started to run, it may communicate with its home base via
email, by contacting a hidden Internet chat channel, or by using a predefined TCP
port, providing the attacker with the computer's IP address. Once activated, the
Trojan can then be instructed to do many things, such as formatting a hard drive,
sending back financial data, attacking another computer, or participating in a
Distributed Denial of Service (aka "zombie") attack against a website. It gets worse.
Trojans may have the ability to capture keystrokes, meaning they can gather
absolutely any data on a victim's computer, including passwords, credit card
numbers, personal communications, files-anything you have, they have. Anything
you do, they can do. Anything you see, they can see.
So how do you find and eradicate these vile vermin? First, understand that although
good virus scanning software may detect and remove many Trojans, typical antivirus
scanners may not detect Trojans. That's because Trojans use techniques to
hide themselves. How then can you find out if you have a Trojan? A major clue to a
Trojan infection is an unexpected open IP port, especially if the port number
matches a known Trojan port. How do you find out which IP ports are open on your
computer? It's easy: use the netstat utility that comes with many operating systems,
including Windows. Here's how on a Windows computer:
1. disconnect the computer from the Internet
2. using Task List, close all programs that connect to the Internet (e.g., email,
1M)
3. close all open programs running in the system tray
209 Robert McMillan, "Mobile Trojan Horse Trots onto PCs," lOG News Service, PCWorld.com, 22
September 2005, ..::http://www.Dcworld.com/news/article/0.aid.122658.OO.asp> (14 November 2006).
UNCLASSIFIEDflIiO~ OlililelAL tJSE ONLY 589