main

First Trojan To Directly Target Microsoft Anti-Spyware

Mr magoo   on 09 February 2005 - 22:33 · 46 comments & 8656 views

Advertisement (Why?)
The Register is reporting that the first trojan to specifically affect Microsoft's Anti-Spyware program has been released. Called BankAsh-A, the trojan steals credit card and other info, turns off anti-virus programs (and disables the beta Microsoft anti-spyware software), deletes files on the computer and downloads code from the internet as well as installing more malware on the computer.

The trojan runs a key logger on infected computers, which captures all kinds of personal information. BankAsh-A is distributed via spam email. Sophos reports that users banking with Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest, Smile and others are affected. Sophos are reporting that so far, the trojans has seen limited distribution.

Microsoft recently announced plans to purchase Sybari Software, a anti-virus company also specialising in spam and security software. Joe Wilcox of Jupiter Research notes that "Competitors and partners should carefully watch Microsoft now. Combined, the three acquisitions give Microsoft the basis on which to release security products for the consumer and business markets." Surely, a complete anti-virus package from Microsoft is only months away.

View: Sophos Trojan Info


"So i happened to look over my finances this past weekend and i realized something: i'm broke. which is odd, because i had a bunch of liquid capital in my checking account last time i checked, and now all of a sudden i have nothing.

i realized the root problem was that google's relocation process requires the employee to pay all the expenses up front and then get reimbursed for them later. that means you have to cover an apartment hunting trip, your final relocation, lease termination fees and temporary housing expenses all in advance. not to mention that they don't pay out your signing bonus and relocation money until your first paycheck (which i haven't received yet). finally, add in the fact that i had to put down two months rent as a deposit for my new lease, and i'm flat broke.

on the plus side, this first paycheck is going to be huge... (which unfortunately means i'll probably end up getting taxed huge on it. doh!)

which led me to thinking about the "benefits" package at google. as i thought about it, i realized that most of the "benefits" actually seem to be thinly veiled timesavers to keep you at work. take for example: free lunch and dinner. now this one is an awesome value proposition for google; i'm not exactly sure why other companies don't also recognize the value and join in. consider this: it probably costs google a maximum of $3 per employee for lunch and $5 per employee for dinner. so that's only $8 per day, but if you think about the fact that the employee now probably only takes a half hour lunch break and also stays late working, the company actually realizes far more than an $8 gain in employee output. not to mention that most people think this is a great "benefit" and google gets a ton of positive press on it. in short, this "benefit" is designed benefit the company, not the employee.

then look at all these other fringe "benefits": on-site doctor, on-site dentist, on-site car washes... the list goes on and on with one similarity: every "benefit" is on-site so you never leave work. i'm not going to say this isn't convenient for us employees, but between all these devices designed to make us stay at work, they might as well just have dorms on campus that all employees are required to live in.

next, let's look at the health care benefit provided. arguably, this is the biggest benefit companies pay out for their employees. google definitely has a program that is on par with other companies in the industry; but since when does a company like google settle for being on par? microsoft's health care benefits shame google's relatively meager offering. for those of you who don't know, microsoft pays 100% of employees' premiums for a world-class PPO. everything you can possibly imagine is covered. the program has no co-pays on anything (including prescription drugs); you can self-refer to any doctor in the blue cross blue shield network, which pretty much means any licensed professional; and you can even get up to 24 hour-long massage sessions per year.

lastly, google demands employees that are 90th percentile material, so what's with the 50th percentile compensation? the packages would've been decent when the company was pre-IPO, but let's be honest here... a stock option with a strike price of $188 just doesn't have the same value as the ones of yesteryear. even microsoft adjusted their base salaries to 66th percentile years ago when it was clear that their stock options weren't as much a part of the total compensation package as it used to be. for a post-IPO company like google, it only seems fair that they adjust things accordingly.

all in all, despite these rants, i still chose to come to google. the work environment, projects and risk/reward equation were all more enticing than up in redmond. but just like when you look for apartments in SF, no option is ever perfect. " (from here, mirrored at Bloglines)

Post a comment · Send to friend Comments · There are 46 additional comments
(2 replies) #1 Xtreme $niper on 09 Feb 2005 - 22:43
Well as long as this stays in email spam, then I'm fine. I block any and all emails that are even semi suspicious. Seems like quite the harsh bug.
#1.1 shao on 10 Feb 2005 - 09:06
i think this is a clear sign that not only are other companies in the security space getting worried at microsoft's recent purchases, but that adware companies, which will lose out BIG TIME when microsoft properly start pushing a retail (or hopefully free) version of antispyware + anti virus.
I've used the beta on several friends and family computers, and it all but totally fixes them. the most infected computer i've found with it had over 3500 'infected' files, and nearly 9000 infected registry keys. excellent! :-)
#1.2 Dane on 10 Feb 2005 - 22:28
QUOTE
i think this is a clear sign that not only are other companies in the security space getting worried at microsoft's recent purchases, but that adware companies, which will lose out BIG TIME when microsoft properly start pushing a retail (or hopefully free) version of antispyware + anti virus.
I've used the beta on several friends and family computers, and it all but totally fixes them. the most infected computer i've found with it had over 3500 'infected' files, and nearly 9000 infected registry keys. excellent! :-)


I think that if it was free people would start to cry Anti-Trust
(1 reply) #2 aleks on 09 Feb 2005 - 23:02
It was only a matter of time....
#2.1 ThaCrip on 10 Feb 2005 - 05:09
yes... but i dont even see this as a problem really.
#3 Liger™ on 09 Feb 2005 - 23:03
Microsoft updated their defination, i think they fixed the bug.
(10 replies) #4 nic on 09 Feb 2005 - 23:05
Microsoft really needs to include some level of anti-virus/anti-spyware into Longhorn in order to make customers happy. Like web browsers, anti-virus software seems to be a necessity these days on computers. Likely to make their competitors very grumpy, however. These malware programs are just getting nastier and nastier.
#4.1 Daninku on 09 Feb 2005 - 23:27
Agree, they should include antivirus and antispyware software for free, if possible, with their future operating systems, including Longhorn; I hope they will. As nic said these type of programs are getting nastier by time, and Microsoft should do something to protect its customers from these ...
#4.2 alan8it on 09 Feb 2005 - 23:30
MS should make their code more secure. Offering these products for free will not bode well for them. More antitrust violations and lawsuits against them for sure. Build better code, the threats will not disappear, but they will be diminished.
#4.3 eilegz on 09 Feb 2005 - 23:31
what about fixing and revamping the entire OS, taking a modular approach

Even with firewall, antivirus, antispyware it seems that its not enough

if they include a antivirus would be very good but the competitors would not be happy with this and then again this eternal antitrust cases raining to microsoft.
#4.4 Mr. Dee on 09 Feb 2005 - 23:37
I think the answer to that is the NGSCB.
#4.5 M2Ys4U on 10 Feb 2005 - 00:07
^ I wish they'd stop changing it's name.

Anyways, the day we're forced to use NGSCB/TC/TCPA/Palladium/whatever is the day I move to *nix and never look back.
#4.6 neufuse on 10 Feb 2005 - 00:35
QUOTE
Anyways, the day we're forced to use NGSCB/TC/TCPA/Palladium/whatever is the day I move to *nix and never look back.


yeah, and what do you do when its the standard and hardcoded onto chips on your motherboard like pheonix bios has already started to do on all motherboards?
#4.7 dismuter on 10 Feb 2005 - 00:35
It only has had two names, Palladium and now, since quite some time, NGSCB.
TCPA is something else.
#4.8 FuhrerDarqueSyde on 10 Feb 2005 - 02:27
come on people, you know damn well if they included their own anti-virii or spyware solution people would sue them for monopolistic practices. OMG YOU INCLUDE YOURS AND WE SUCK CAUSE OF IT *&#%* MOAN AND COMPLAIN!!1
#4.9 TrekXP on 10 Feb 2005 - 02:33
yep, then the EU would rule they must remove it , its really dumb heh.
#4.10 threedaysdwn on 10 Feb 2005 - 06:30
Um, what's wrong with NGSCB? Everything I've seen thus far looks rather promising.

QUOTE
what about fixing and revamping the entire OS, taking a modular approach


What do you mean by that?

I think it would be nice if they'd move DirectX (and other junk) back out to userland. And it looks like Longhorn will make some serious progress towards bringing Least Privilege computing to the home. That alone will make most problems like this just go away.
#5 Mr. Dee on 09 Feb 2005 - 23:28
Yeah, as long as you update, there shouldn't be any problems. I think the update definition for this is 5687.
(3 replies) #6 rIaHc3 on 10 Feb 2005 - 00:41
This shows how powerful MSAS is and how good it blocks spyware. They accually make trojans to disable it.
#6.1 AndyD on 10 Feb 2005 - 01:49
Exactly what I was thinking. I've had 0 spyware since I installed GIANT Antispyware (now running MS Beta). Spybot and Adaware are now no longer needed
#6.2 shichiroji4 on 10 Feb 2005 - 08:44
QUOTE
This shows how powerful MSAS is and how good it blocks spyware. They accually make trojans to disable it.


That's some kind of baloney you have there. MSAS got comprimised and the best you can come up with is 'trojans prove MSAS is powerful'? I see M$ fanboys will really resort to any sill excuses to save their precious OS.
#6.3 SquareSoft0 on 10 Feb 2005 - 10:10
I won't get into your multiple spelling mistakes, but Microsoft already fixed their software from this trojan. You can stop touching yourself to this article, shichi-boy.
(2 replies) #7 anir on 10 Feb 2005 - 01:05
Knowledge is the best security.
#7.1 EduardValencia on 10 Feb 2005 - 01:47
duly noted
#7.2 lare2 on 10 Feb 2005 - 16:30
true
#8 Gowcra on 10 Feb 2005 - 01:08
Scarey ****!
#9 webeagle12 on 10 Feb 2005 - 02:00
wow security at Microsoft didnt last too long
#10 dhan on 10 Feb 2005 - 03:09
The Register come on. Even if its a real bug, its not that Windows will stop working all over the world
hmm what am I saying...register always sets me on a monologue
(3 replies) #11 shichiroji4 on 10 Feb 2005 - 03:10
What a joke, M$ invited more problems than they solved with a proggie they bought from someone else. The entire Windows is a ****hole that no amount of antivir or antispy will help.

Some people are just too brainwashed to do a careful calucation. Mac may be more expensive initially, but Windows sucks you dry in the long run. Penny wise but pound foolish.
#11.1 threedaysdwn on 10 Feb 2005 - 06:32
Oh come on, you can do better than that.
#11.2 SquareSoft0 on 10 Feb 2005 - 07:19
Really, this is yet another 1/10 on the troll scale, you need to go back to the troll academy.
#11.3 wildk on 10 Feb 2005 - 13:13
QUOTE
What a joke, M$ invited more problems than they solved with a proggie they bought from someone else. The entire Windows is a ****hole that no amount of antivir or antispy will help.

Some people are just too brainwashed to do a careful calucation. Mac may be more expensive initially, but Windows sucks you dry in the long run. Penny wise but pound foolish.


Aw bless.. look he's throwing another tantrum, what's the matter couldn't setup a windows system properly, Funny thing is you rant about how bad Microsoft (Yes shichi that's how it is spelt) yet i have never had any problems, No exploits, no viruses, no spyware, (and i still use IE Gasp....)

Go back to troll school and come back when you can hold a decent argument, even your knee jerk rantings are becoming second rate un-informed garbage.
(3 replies) #12 FightingChance on 10 Feb 2005 - 03:50
Man, who writes these things? They need to have one of their fingers cut off for every virus they write. Let's see you program with nubs.
#12.1 SquareSoft0 on 10 Feb 2005 - 07:20
I once knew a virus writer with most of his fingers missing from an accident.
#12.2 PayneX on 10 Feb 2005 - 07:38
Ah yes, the Stubby.C Trojan author.
#12.3 SquareSoft0 on 10 Feb 2005 - 10:12
As far as I know, he could have written that.
(2 replies) #13 ThePDW on 10 Feb 2005 - 17:01
So, the question is, when they catch this guy, should he be drawn and quartered or just beheaded?
#13.1 cylonite on 10 Feb 2005 - 17:50
why?? bcoz he just proved that Microsofts talk of security was just bull?
#13.2 SquareSoft0 on 10 Feb 2005 - 18:26
^^^
Sorry, you must be at least ---this--- intelligent to ride The Internet.
(2 replies) #14 tcool93 on 10 Feb 2005 - 17:48
Your foolish to run any "anti" spyware program written/owned by Microsoft. I said that before this even happened. Microsoft is IN the spyware business, not one that gets rid of it.
#14.1 SquareSoft0 on 10 Feb 2005 - 18:25
I don't even have to respond to make him sound stupid.
#14.2 NetRyder on 12 Feb 2005 - 10:15
Hahaha....that made my day.
#15 minigun on 10 Feb 2005 - 19:43
i dont run any anti spyware (check with spybot S&D every few months) and i never had any infections... and i only use IE
#16 neocyber_16 on 10 Feb 2005 - 20:13
Scary idea seeing the evolution of trojans. Wonder what a trojan would be like in 10, 20 years from now.
#17 Cyranthus on 11 Feb 2005 - 20:04
sounds pretty nasty.. doesnt look like i should be affected though...
#18 capeche on 13 Feb 2005 - 17:16
As with antivirus software, all these antispyware programs are flawed, so I don't use any of them!

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)