Dave Budd said:
Bzzzt.
The definition of a trojan is that it's a complete program in its own
right, not a modification of an existing one.
No, most definitions for trojan make no reference to whether or not the program is a modified version of a preexisting
program or a 'built from the ground up' malware file. If it does something else (instead of or in addition to) what the user
is lead to believe it does - it is a trojan. The 'complete program' that you mention is usually a differentiating characteristic
between the type of 'virus' that infects program files and the type of 'worm' that uses a host machine rather than just a host
process. This type of worm creates program files instead of using preexisting ones. Peeps always have a tendency to prefer
definitions for malware that exclude other types of malware, but this is not really how these things are defined.
They may, of course, do all kinds of things to /other/ files once they
get in and run, but the actual trojan is just a program you don't want
and should be deleted.
That depends on the specific trojan involved, but this is usually correct. You should be careful though, a downloader trojan
in the startup folder could have downloaded and executed its target file the first day and then deleted the downloaded file
once the new program was installed, and then on a subsequent download another different program gets installed - if the
programmer had seven programs he wanted installed he may have had a guardian program running to detect any interference
such as you attempting to delete the downloader. You shouldn't assume that because the AV says it is a "Trojan" that it is
safe to 'just delete' the file. As far as cleaning modified program files goes - many will say it is always better to replace than
it is to clean even if a cleaning is possible.
I can't remember the exact malware, but there was a worm that modified windows media player to become a downloader
trojan - it wasn't a parasitic modification (lost its original function), but it caused a download and execution of foriegn code
whenever a media file was chosen (double-clicked). If it had been a parasitic modification it might have been cleanable by
removal software and yet still have been a trojan by definition.
