A trojan virus is a type of malicious software that pretends to be something safe, such as a free app, a PDF invoice or a software update, so you install it yourself. Once it’s inside your device, it can steal passwords, spy on your activity, damage files or give criminals remote control of your computer or phone.
Trojans are one of the most common types of malware, and they’re hard to spot because they rely on tricking people rather than breaking in. This guide explains what trojans are, what they can do, how to tell if you have one, and how to remove it from a computer or phone.
What Is a Trojan Virus?
A trojan virus, also called a trojan horse or simply a trojan, is a program that disguises itself as legitimate software while carrying out harmful actions in the background. The name comes from the story of the Trojan Horse in Greek mythology: the gift looked harmless, but it hid something dangerous inside.
A trojan usually arrives in one of these disguises:
- A free or cracked version of paid software, games or media
- An email attachment that looks like an invoice, delivery notice or CV
- A fake software update or browser extension
- A “free” app from outside an official app store
- A pop-up claiming your device is infected and you need to install a cleaner
The key point is that you run it willingly. The trojan doesn’t force its way in. It convinces you to open the door.
What Is Trojan Malware? (And Is a Trojan Really a Virus?)
Strictly speaking, a trojan is malware, not a virus. “Malware” is the umbrella term for any malicious software, and trojans are one category within it. The phrase “trojan virus” is widely used, and it’s what most people search for, but the technical difference matters:
- Virus: attaches itself to files and spreads by copying itself into other files or programs.
- Worm: spreads by itself across networks without needing you to do anything.
- Trojan: does not copy itself. It depends on tricking you into installing it, then does its damage or opens a path for other malware.
Because trojans don’t replicate, they spread through deception: phishing emails, malicious downloads, compromised websites and fake apps. This is also why they’re often used as a “delivery vehicle” that downloads ransomware, spyware or other malware once it’s established.
Common Types of Trojan Malware
Trojans are grouped by what they do once they’re running:
- Backdoor trojans create a hidden way for an attacker to access and control your device.
- Remote access trojans (RATs) give an attacker full remote control, including the ability to see your screen, files and webcam.
- Banking trojans target online banking and payment details, often by overlaying fake login screens.
- Infostealers collect saved passwords, browser cookies, cryptocurrency wallets and personal files.
- Downloaders and droppers install other malware, such as ransomware, after they get in.
- Fake antivirus trojans pretend to find problems on your device and demand payment to fix them.
- SMS and premium-rate trojans (mostly on Android) send text messages or sign you up to paid services without your knowledge.
- Cryptominers quietly use your device’s processing power to mine cryptocurrency.
What Can a Trojan Virus Do?
The damage depends on the type of trojan, but common outcomes include:
- Stealing personal information: logins, banking details, credit card numbers, identity documents and saved browser data.
- Giving remote access to criminals: attackers can view, copy, change or delete files, or use your device to attack others.
- Installing more malware: ransomware, spyware, adware or keyloggers can follow the initial infection.
- Spying on you: recording keystrokes, taking screenshots, or accessing your webcam and microphone.
- Corrupting or deleting data: some trojans damage files or make your system unstable.
- Slowing down or crashing your device: especially cryptominers and trojans that run heavy background processes.
- Turning your device into a “zombie”: your computer can be added to a botnet and used to send spam or launch attacks without you knowing.
- Causing financial loss: through stolen banking details, fraudulent purchases or premium-rate charges.
For businesses, a single trojan can lead to a data breach, downtime and a privacy incident that has to be reported, so staff awareness matters as much as software protection.
What Is a Trojan on a Computer?
On a Windows PC or Mac, a trojan is typically a program or file that you download and open believing it’s genuine. Windows machines are the most commonly targeted because of their market share, but Macs are not immune, and Mac-specific trojans and infostealers do exist.
On a computer, trojans commonly arrive through:
- Email attachments, such as .zip, .exe, .iso, Word or Excel files with macros
- Pirated software, key generators and “cracks”
- Fake installers for popular tools like PDF editors, video players or VPNs
- Malicious ads and compromised websites that push fake browser updates
- USB drives and downloads from file-sharing sites
Once installed, a computer trojan can run quietly at startup, hide from the list of visible programs and connect to a remote server to receive instructions from its operator.
What Is a Trojan Virus on a Phone?
A trojan on a phone is a malicious app, or a normal-looking app with hidden malicious behaviour. It is far more common on Android than on iPhone, mainly because Android allows apps to be installed from outside the official store and gives apps wider access to the system.
Phone trojans often:
- Pose as flashlight apps, games, photo editors, battery savers, QR scanners or fake banking apps
- Ask for unusual permissions, such as access to SMS, accessibility services or device administrator rights
- Show intrusive ads, steal login codes or overlay fake login screens on top of real banking apps
- Send premium text messages or subscribe you to paid services
What about iPhones? iPhones are much harder to infect because of strict app review and sandboxing. True trojans are rare, but iPhone users can still be caught out by malicious configuration profiles, phishing links, fake apps that trick you into giving away your Apple ID, and jailbroken devices that bypass Apple’s protections.
How Trojans Get Onto Your Device
Understanding the entry points helps you avoid them. The most common routes are:
- Phishing emails and texts containing infected attachments or links
- Software downloads from unofficial websites or file-sharing platforms
- Fake updates that appear while you’re browsing
- Malicious apps installed outside the official app stores, or occasionally slipping through them
- Social engineering, such as a caller or message convincing you to install “support” software
- Bundled installers where a trojan is hidden in the “optional extras” of a free program
How to Tell if You Have a Trojan Virus
Some trojans are designed to stay hidden, so there may be no obvious symptoms. But these warning signs are worth taking seriously.
Signs on a Computer
- Your computer is suddenly slow, freezes or crashes more than usual
- Programs you don’t recognise appear, or settings change without your input
- Your browser home page, search engine or extensions change on their own
- Constant pop-ups or fake security warnings appear
- Your antivirus has been switched off and won’t turn back on
- Fans run loudly or the CPU is busy while you’re doing nothing
- Unusual network activity, or your internet is slower than normal
- Files are missing, renamed or won’t open
- Friends or colleagues receive strange emails or messages from your accounts
- Your mouse or keyboard seems to act on its own
Signs on a Phone
- The battery drains much faster than normal, or the phone feels hot
- Data usage spikes without explanation
- Apps you didn’t install appear, or apps crash and open ads
- Unexpected text messages, charges or calls to premium numbers
- Pop-ups appear outside of your browser
- You’re asked to grant admin or accessibility permissions to an app that doesn’t need them
How to Confirm It
- Run a full scan using trusted security software
- On Windows, check Task Manager and the Startup tab for unfamiliar entries
- On Android, review Settings > Apps and Device admin apps
- On a Mac, check Login Items and Activity Monitor
- Check whether your accounts show logins from unfamiliar locations
If several signs appear together, treat it as an infection until proven otherwise. Keep in mind that some of these symptoms can also be caused by ageing hardware or a failing hard drive, so a scan is the only reliable way to confirm.
How to Remove a Trojan Virus
Act quickly but calmly. The steps below cover the most common situations.
Removing a Trojan From a Windows PC
- Disconnect from the internet. Turn off Wi-Fi or unplug the network cable so the trojan can’t send data out or download more malware.
- Back up important files carefully. Copy documents and photos to an external drive, but avoid copying programs or system files. Scan the backup later before opening anything.
- Boot into Safe Mode with Networking. This loads only the essentials, which stops many trojans from running.
- Uninstall suspicious programs. Go to Settings > Apps and remove anything you don’t recognise or recently installed.
- Check startup items. In Task Manager > Startup, disable unfamiliar entries.
- Run a full scan. Use Microsoft Defender, including Microsoft Defender Offline scan, and a second-opinion scanner from a reputable security vendor.
- Quarantine or delete what’s found, then restart and scan again to make sure it’s clean.
- Update everything. Install all Windows updates and update your browsers and apps.
- Change your passwords from a different, clean device, starting with email, banking and any account that matters. Turn on two-factor authentication.
Removing a Trojan From a Mac
- Disconnect from the internet.
- Open Activity Monitor and look for processes using unusual amounts of CPU or memory.
- Remove unknown apps from Applications and unfamiliar entries from System Settings > General > Login Items.
- Remove unknown browser extensions.
- Run a scan with reputable Mac security software and install all macOS updates.
- Change your passwords from a clean device.
Removing a Trojan From an Android Phone
- Turn on Airplane mode, or turn off Wi-Fi and mobile data.
- Restart in Safe Mode (usually by holding the power button, then pressing and holding “Power off”). Third-party apps are disabled in Safe Mode.
- Go to Settings > Apps and uninstall anything unfamiliar or recently added. If an app won’t uninstall, check Settings > Security > Device admin apps and remove its admin rights first.
- Open the Google Play Store > Play Protect and run a scan.
- Update Android and your apps.
- If the problem continues, back up your photos and contacts and factory reset the phone. Don’t restore apps from a backup you suspect is infected.
- Change passwords for your Google account, banking and other key accounts.
Removing a Trojan From an iPhone
- Update iOS to the latest version.
- Delete any apps you don’t recognise.
- Go to Settings > General > VPN & Device Management and remove any unknown configuration profiles.
- Clear Safari history and website data, and remove unknown extensions or calendar subscriptions.
- Change your Apple ID password and check which devices are signed in.
- If the iPhone still behaves strangely, back up your data and restore it to factory settings. If it’s jailbroken, restoring is the best way to return it to a protected state.
When a Full Reset Is the Safest Option
Some trojans bury themselves deeply, especially rootkits and trojans that have installed other malware. If scans keep finding threats, your security software keeps getting disabled, or you’ve had banking or identity details stolen, the safest path is often to back up your personal files, wipe the device and reinstall the operating system. It’s more work, but it removes any doubt. If you’re unsure, getting an IT professional to check the device is a sensible step.
What to Do After Removing a Trojan
- Change passwords and enable two-factor authentication everywhere that matters
- Check bank and card statements and contact your bank straight away if you see anything suspicious
- Watch your accounts for unusual logins
- Consider setting up credit monitoring if identity details were taken
- Report it. In New Zealand, you can report cyber incidents to the National Cyber Security Centre (NCSC) at ncsc.govt.nz, and get help with scams and online harm from Netsafe at netsafe.org.nz
How to Prevent Trojan Infections
Prevention is far easier than removal. A few habits stop most trojans:
- Only download software from official sources, such as the developer’s website or official app stores.
- Avoid pirated software and cracks. They’re one of the most common ways trojans spread.
- Think before you open attachments or links, even if they appear to come from someone you know. Check the sender’s address and look for odd wording or urgency.
- Keep your system, browser and apps updated so known security holes are patched.
- Use reputable security software and keep real-time protection switched on.
- Use a standard user account for everyday tasks rather than an administrator account.
- Review app permissions on your phone and deny anything that doesn’t make sense.
- Turn on multi-factor authentication so a stolen password alone isn’t enough.
- Back up your data regularly, with at least one copy kept offline, so you can recover without paying a criminal.
- Be sceptical of pop-ups claiming your device is infected. Close the window and don’t click anything inside it.
Frequently Asked Questions
Can a trojan virus steal my passwords?
Yes. Infostealers and banking trojans are designed to capture saved passwords, keystrokes and session cookies. If you suspect an infection, change your passwords from a clean device.
Can a trojan infect my phone just by visiting a website?
It’s uncommon. Most phone trojans need you to install an app or approve a permission. The greater risk comes from tapping malicious links, installing apps from unofficial sources or approving unusual permission requests.
Does a factory reset remove a trojan?
In most cases, yes. A factory reset or clean operating system reinstall removes the vast majority of trojans. Don’t restore from a backup that may contain the infected files or app.
Can antivirus software detect every trojan?
No security tool catches everything, especially brand-new threats. That’s why safe habits, updates, backups and a second-opinion scan are all worthwhile.
Is a trojan the same as ransomware?
No, but they’re often connected. A trojan can be the way ransomware gets onto your device. Ransomware is defined by what it does (locking or encrypting your files for payment), while a trojan is defined by how it gets in (by pretending to be something safe).
Do Macs and iPhones get trojans?
Yes, though less often than Windows PCs and Android phones. Mac trojans and infostealers exist, and iPhone users can still be targeted through phishing, malicious profiles and fake apps.
Final Thoughts
A trojan virus works because it looks harmless. The best defence is a mix of healthy scepticism, up-to-date software and regular backups. If you spot the warning signs, disconnect from the internet, scan, remove the threat and change your passwords from a clean device. And if you’re not confident the device is clean, a full reset or a professional check is worth the effort.