Are we protected against. Bankash-A

Discussion in 'NOD32 version 2 Forum' started by tempnexus1, Feb 10, 2005.

Thread Status:
Not open for further replies.
  1. tempnexus1

    tempnexus1 Guest

    http://news.com.com/Trojan attacks ...re/2100-7349_3-5569429.html?tag=st.rc.targ_mb


    Virus writers have created a malicious program that can disable Microsoft's new anti-spyware application, security experts warned on Wednesday.

    Antivirus experts, who are calling the Trojan "Bankash-A," say it is the first piece of malicious software to attack Windows AntiSpyware, which is still in beta.

    "This appears to be the first attempt yet by any piece of malware to disable Microsoft AntiSpyware," Graham Cluley, a senior technology consultant at Sophos, said in a statement. "As Microsoft's product creeps out of beta and is adopted more by the home user market, we can expect to see more attempts by Trojan horses, viruses and worms to undermine its effectiveness."

    Windows AntiSpyware, built using technology from Microsoft's acquisition of Giant Company Software, is designed to protect Windows PCs from spyware--software that is installed on computers without their owners' knowledge. Typically, spyware generates pop-up ads or keeps track of people's Web surfing.

    Like many other Trojans, Bankash attempts to steal passwords and online banking details from Windows users, Sophos said in an advisory. The program targets users of U.K. online banks such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest and Smile.

    Sophos called the Trojan "Bankash" because it attacks banking customers and installs a file called ASH.DLL onto a victim's hard drive.

    Microsoft's British press office was awaiting comment from the company's U.S. headquarters at the time of writing
     
  2. sir_carew

    sir_carew Registered Member

    Joined:
    Sep 2, 2003
    Posts:
    884
    Location:
    Santiago, Chile
    Yes, NOD32 detect this as Win32/TrojanDownloader.Small.AIN trojan.

     
  3. DonKid

    DonKid Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    566
    Location:
    S?o Paulo, Brazil
    Sir_carew,

    I was looking in Virus signature database updates and couldn´t find the Bankash-A name, as you told it has the Win32/TrojanDownloader.Small.AIN trojan name.
    Can you tell me how I recognize it with another name ?

    Thanks,

    DonKid.
     
  4. sir_carew

    sir_carew Registered Member

    Joined:
    Sep 2, 2003
    Posts:
    884
    Location:
    Santiago, Chile
    http://www.viruslist.com/en/viruses/encyclopedia?virusid=73190

     
  5. DonKid

    DonKid Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    566
    Location:
    S?o Paulo, Brazil
Thread Status:
Not open for further replies.