What is a Trojan virus? How Trojans get in — and how to remove one

The name comes from the wooden horse of Greek legend: a gift that hid soldiers inside. A Trojan horse is a program that appears to do something useful but also has a hidden, malicious function, in NIST's definition. You install a free game, a "cracked" app or a file that looks like an invoice — and get something else along with it.

Is a Trojan a virus?

Not technically, although "Trojan virus" is the name most people search for. A virus spreads by modifying other programs to include a copy of itself. Trojans can't spread on their own, Microsoft explains: they have to be downloaded by you or installed by other malware. That's why the defence against them is mostly about what you choose to run.

How Trojans get onto your device

• Look-alike apps. Trojans often use the same file names as real, legitimate apps, and Apple notes that a common way to spread malware on a Mac is to embed it in a harmless-looking app.
• Pirated software and "keygens" — key-generator tools often install malware at the same time, Microsoft warns.
• Email attachments that claim to be a delivery receipt, a tax refund or an invoice.
• Bogus ads for software on search engines and social media.
• Fake "verify you're human" pages. The US FTC warns about CAPTCHA scams that tell you to press certain keys or paste text into a box — following the steps actually runs hidden malware on your device.

What a Trojan does once it's in

• Installs more malware.
• Records your keystrokes, and sends your passwords and browsing history to the attacker.
• Opens a backdoor — an undocumented way into your computer — or hands an attacker control of the device.
• Collects banking credentials and other information that can be sold.

Signs can be the same as for any malware — a slower computer, new toolbars, pop-ups, messages you didn't send — or there may be nothing visible at all. That's why a scan with up-to-date security software matters.

How to remove a Trojan

1. Disconnect from the internet. The US FTC says this stops scammers from getting into your online shopping or banking accounts.
2. Run a full scan with up-to-date security software and remove whatever it finds. On Windows, Microsoft Defender Antivirus is built in, Microsoft also offers the free Microsoft Safety Scanner, and the offline scan in Windows Security runs before Windows loads.
3. Uninstall the program you installed just before the trouble started.
4. Change your passwords using a different device, starting with email and banking, and turn on two-factor authentication.
5. Watch your bank and card statements, and call your bank if you see anything you don't recognise.
6. If problems continue, contact the device maker's support or a technician you trust.

How to avoid Trojans

• Download software only from the vendor's official website or the app store.
• Skip cracked software and key generators — however tempting the price.
• Don't open attachments you weren't expecting, even from names you know.
• Never paste commands or press key combinations a website tells you to, to "prove you're human".
• Use a standard, non-administrator account for everyday use, and keep real-time protection on.

Can phones get Trojans?

Android phones can install harmful apps, mostly from outside Google Play; Play Protect checks apps from the Play Store and other sources, and Google recommends keeping it on. On an iPhone, apps come from the App Store and run sandboxed, so the bigger risks are phishing messages and account takeover.

A Trojan needs your permission to get in. The best defence is being picky about where your software comes from.