Virus sets sights on Microsoft AntiSpyware

[Tami]

Virus sets sights on Microsoft AntiSpyware
By JACK KAPICA
Globe and Mail Update



Microsoft's AntiSpyware package has not even been released as a finished product, and already it's been hit by a virus.

The BankAsh-A Trojan, as security company Sophos calls it, is the first piece of malware to attack the product, currently available only as a beta download from Microsoft's website.

Designed to steal on-line banking passwords from unsuspecting Windows users, BankAsh disables Microsoft AntiSpyware, attempting to suppress warning messages that Microsoft AntiSpyware may display and deleting all files within the program's folder.

The Trojan also targets users of on-line banks such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest and Smile, Sophos said.

"This particular attempt appears to be the first by any piece of malware to disable Microsoft AntiSpyware, but it may be the first of many such future attacks," Sophos analyst Gregg Matsoras said in a statement. "When Microsoft's product is officially released and adopted by the consumer market, we can likely expect to see an increase in attempts by Trojan horses, viruses and worms to try and undermine its effectiveness."

Mr. Matsoras said his company has been noting an increase in the volume of Malware that is being written by criminals, designed to steal bank account information from users.

"Internet users around the world really need to ensure that their computers are properly defended with the most up-to-date protection against viruses, spam and malicious spyware."

In related news, Internet Security Systems, Symantec and McAfee antivirus companies have announced updated fixes for a series of vulnerabilities announced today by Microsoft.

McAfee, Inc. announced protection for the 17 vulnerabilities announced in a dozen bulletins, and urged users to confirm the Microsoft product versioning outlined in its bulletins and update their systems with patches from both Microsoft and for its own products.

Seven of the security vulnerabilities were called "critical" by Microsoft, and affect the Windows operating system and related software, including the Internet Explorer browser, media player and instant messaging program. The eighth is with the company's Office XP business software.

The problems range in scope from a vulnerability in ASP.NET that, if exploited, could allow an attacker to bypass the security of an ASP.NET website and gain unauthorized access to parts of a site, to a vulnerability in the Licence Logging service that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.

Internet Security Systems released pre-emptive protection for all the vulnerabilities announced by Microsoft today. The ISS considers two to be a serious threat to enterprise organizations — the Licence Logging Service Vulnerability (MS 05-010) and the Server Message Block (SMB) Client Vulnerability (MS 05-011).

Symantec Security Response, maker of Norton Antivirus, identified nine vulnerabilities as the most serious, including the MS Word Buffer Overflow Vulnerability, the PNG Processing Buffer Overflows, and the Windows Messenger Service, MSN Instant Messenger and Windows Media Player 9.

"Blended threats, worms and exploit code that takes advantage of newly discovered and announced software vulnerabilities continue to be a concern for both consumers and enterprises," Symantec's Oliver Friedrichs said. "With the time between the disclosure of a vulnerability and publication of exploit code dropping to 5.8 days, new vulnerabilities pose an increasing risk to unpatched systems."

Symantec recommended that enterprises evaluate the impact of these vulnerabilities to their critical systems, plan for patch deployment, and take steps to protect the integrity of networks and information.

For home users, Symantec recommends regularly running Windows Update and installing the latest security updates to keep software up to date.

[url=\"http://www.globetechnology.com/servlet/story/RTGAM.20050209.gtspyfeb9/BNStory/Technology/\"]source[/url]