1. A method performed by a computer system for determining propagation relationships of Trojan horse files, the method comprising: storing a current Trojan horse file into a corresponding current level of a propagation relationship tree; determining whether a relationship condition of the current Trojan horse file or of the propagation relationship tree, is satisfied; and repeating the following steps until the relationship condition is satisfied: searching Trojan horse files for a parent, child or sibling relationship to the current Trojan horse file, identifying one of the Trojan horse files as the current Trojan horse file, and storing the current Trojan horse file into a corresponding current level of the propagation relationship tree; and displaying the propagation relationship tree when the relationship condition is satisfied.