It's not self-propagating, so it can't be called a virus or a worm.

It's not remotely initiatable, so you can't really think of it as an automatedly run remote exploit.

SANS defines a trojan horse as "A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program."

To me, Flashback falls in this category. Flashback is part of a program that appears to have a useful function: Java. (No jokes about whether or not Java actually or only appears to have a useful function.) It could also be considered part of the web browser being used. It clearly matches the other parts of the definition.

There are obviously some leaps of logic in that argument, though.