Breaking News: Trojan attacks Microsoft's anti-spyware

Virus writers have created a malicious program that can disable Microsoft's new anti-spyware application, security experts warned on Wednesday.

AdwareReport Comment: Microsoft has made themselves a lot of enemies over the years and despite their latest attempt to resolve their nagging security problems through the purchase of Giant AntiSpyware, all they have succeeded at doing is making themselves a bigger target. One of the biggest problems that spyware programmers face in trying to defeat anti-spyware tools are the wide variety of tools available out there. Microsoft has inadvertently shot itself in the foot by trying to mass-market one.

By Dan Ilett ZDNet (UK) February 9, 2005, 9:54 AM PT

Antivirus experts, who are calling the Trojan "Bankash-A," say it is the first piece of malicious software to attack Windows AntiSpyware, which is still in beta.

"This appears to be the first attempt yet by any piece of malware to disable Microsoft AntiSpyware," Graham Cluley, a senior technology consultant at Sophos, said in a statement. "As Microsoft's product creeps out of beta and is adopted more by the home user market, we can expect to see more attempts by Trojan horses, viruses and worms to undermine its effectiveness."

Windows AntiSpyware, built using technology from Microsoft's acquisition of Giant Company Software, is designed to protect Windows PCs from spyware--software that is installed on computers without their owners' knowledge. Typically, spyware generates pop-up ads or keeps track of people's Web surfing.

Like many other Trojans, Bankash attempts to steal passwords and online banking details from Windows users, Sophos said in an advisory. The program targets users of U.K. online banks such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest and Smile.

Sophos called the Trojan "Bankash" because it attacks banking customers and installs a file called ASH.DLL onto a victim's hard drive.

Microsoft's British press office was awaiting comment from the company's U.S. headquarters at the time of writing.

Dan Ilett of ZDNet UK reported from London.