A method performed by a computer system determines propagation relationships of Trojan horse files. A current Trojan horse file is stored into a corresponding current level of a propagation relationship tree. A condition of the current Trojan horse file or of the propagation relationship tree is assessed. The following steps are repeated until the condition is satisfied: search Trojan horse files for a parent, child or sibling relative to the current Trojan horse file, identify one of the Trojan horse files as the current Trojan horse file, and store the current Trojan horse file into a corresponding current level of the propagation relationship tree. When the condition is satisfied, the propagation relationship tree is displayed. The storing of the current Trojan horse file may include storing an identifier of the current Trojan horse file, which may include data abstraction output, and/or a downloading address of the current Trojan horse file.