Most Trojans use an auto-starting method that allows them to restart and grant an attacker access to your machine even when you shut down your computer. The evolutionary rate, as estimated by BEAST, is very low with on average 2.07 × 107 SNPs/site/year (0.71 SNPs/genome/year) for the ST37 lineage (Table 2).

ADSL users have static IPs, meaning that in this case, the infected IP is always known to the attacker this makes it considerably easier for an attacker to connect to your machine. This system is used when the victim has a dynamic IP, that is, every time he connects to the Internet, he is assigned a different IP (most dial-up users have this). Many Trojans include the ability to mail the victim’s IP and/or message the attacker via ICQ or IRC. It is necessary for the attacker to know the victim’s IP address to connect to his/her machine. When a Trojan server runs on a victim’s computer, it (usually) tries to hide somewhere on the computer it then starts listening for incoming connections from the attacker on one or more ports, and attempts to modify the registry and/or use some other a uto-starting method. The protocol usually used for communications is TCP, but some Trojans' functions use other protocols, such as UDP, as well. (unknowingly) runs a Trojan server on his machine, the attacker then uses the client part of that Trojan to connect to the server module and start using the Trojan.

Beast 2.07 zip