Banking Trojan Alert

[pautai]

Banking Trojan disables MS Anti-Spyware

By John Leyden

Published Wednesday 9th February 2005 15:48 GMT

The first piece of malware to attack Microsoft's new prototype anti-spyware product has emerged. The BankAsh-A Trojan disables Microsoft AntiSpyware Beta in an attempt to suppress any warning messages the package might display. It also deletes files within the program's folder. Unlike other items of malware, BankAsh-A makes no attempt to turn off anti-virus apps.

The main function of BankAsh-A is to steal online banking passwords from unsuspecting Windows users. The Trojan targets users of UK online banks such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest, and Smile. The malware records passwords and keystrokes once users of infected machines visit targeted websites. This data is then surreptitiously transmitted to crooks, allowing fraudsters to later empty bank accounts. Rather than spreading under its own steam, BankAsh-A needs by distributed by either spam emails or by loading it onto a maliciously constructed website. Anti-virus firms say they've received a handful of reports of the Trojan.

The use of malicious code and phishing scams in frauds cost banks an estimated £4.5m over the last year, according to October 2004 estimates from banking group APACS. APACS and UK police warn that the use of malicious code in such attacks in beginning to eclipse conventional phishing attacks in its severity. Guidelines on how banking customers can stay safe online can he found here. ®