Wednesday, December 20, 2006

Skype Trojan Horse on the loose, but removal’s easy

Russel Shaw reports:
Yesterday Websense Security Labs reported that there was a potential Worm propagating via Skype (see:
http://www.websense.com/securitylabs/blog/blog.php?BlogID=101). After investigation we have discovered that this is not a self propagating worm and is actually a Trojan Horse.

After discussions with the very helpful Skype security team, the behavior of this Trojan using the Skype API is as per the specifications of the API. The end-user who is running Skype does get notified that a program is attempting to access it and must acknowledge it.
*there is no vulnerability in Skype at this time that has been uncovered*
For more details on the Skype API see
https://developer.skype.com/Docs/ApiDoc/Overview_of_the_Skype_API

At the time of this alert the websites that were used to download the Skype API code and the site that is used to download new copies of the Trojan were both down.
Websense says the original infections appear to be occuring in the Asia Pacific region, especially Korea.


According to Symantec, here's what happens when this piece o' crap launches executes:

1) Searches the registry for the location of the Skype application.


2) Displays the following message and then exits if it cannot find the registry: Error!I could not find Skype !


3) Executes the Skype application and displays the following message if it finds the registry:Warning!Allow this program in skype!

4) Queries Skype for random users every 3 minutes.


5) Starts the Skype application and sends the following message to the users:Check this! [http://]marx2.altervista.org/surpr[REMOVED]

All that said, this appears to be some pretty weak malware. Symantec says so.
Removal via Symantec's daily virus definition update fixes this…

24 comments:

  1. Anonymous8:56 pm

    Hey There. I found your blog using msn. This is a very well written article.
    I will be sure to bookmark it and return to read more of your useful information. Thanks for the post.
    I'll definitely return.

    ReplyDelete
  2. Anonymous10:26 pm

    Tһank you for tһe gߋod writeup. It in fact was a amusement account it.
    Look ɑԁvɑnced to more added agreeable from yoᥙ!
    By the way, how can we communicate?

    ReplyDelete
    Replies
    1. Thank you!

      You can contact me with the contact form in the right side bar. But please note that I do NOT blog about Skype any more!

      Helen

      Delete
  3. Anonymous4:45 am

    I am forever thought about this, appreciate it for posting.

    ReplyDelete
  4. Anonymous10:27 pm

    Very interesting info!Perfect just what I was searching for!

    ReplyDelete
  5. Anonymous10:02 pm

    Hello, There's no doubt that your site might be having internet browser compatibility problems.
    When I take a look at your web site in Safari, it looks fine however, when opening in I.E., it has some overlapping issues.
    I merely wanted to provide you with a quick heads up! Aside from that, fantastic website!

    ReplyDelete
  6. Anonymous4:18 pm

    Some truly marvellous work on behalf of the owner of this site, utterly great subject material.

    ReplyDelete
  7. Anonymous8:12 am

    Thanks for sharing your thoughts about online alarm
    clock ms. Regards

    ReplyDelete
  8. Anonymous5:22 pm

    I loved aѕ mᥙch as you wilⅼ receive caгried out
    right here. The sketch is attractive, уour authored subject matter stylіsh.
    nonetheless, you command get got an impatience over that yoᥙ wish be delivering the following.

    unwell unquestionaƄly come more formеrly agɑin since exaϲtly the same neɑrly very often inside case you shield this hike.

    ReplyDelete
  9. Anonymous10:20 pm

    Keep up the excellent piece of work, I read few content on this web site and I believe that your web site is real interesting and has bands of great info.

    ReplyDelete
    Replies
    1. Thank you very much for your appreciated reply! :-)

      Delete
  10. Anonymous6:13 pm

    I usually do not leave a leave a response, but after reading
    a lot of responses on this page Untitled. I actually do have 2 questions for you if you tend not to mind.
    Is it simply me or does it seem like some of the responses look
    like they are written by brain dead people? :-P And, if you
    are posting on other places, I'd like to follow you.
    Would you post a list of the complete urls of your public sites like your twitter feed, Facebook page
    or linkedin profile?

    ReplyDelete
    Replies
    1. Thank you for your comment :-)

      I post indeed in other places but not about Skype.
      All the other sites (Facebook, Twitter etc) are listed in the header of this Blog! I hope this helps.

      Helen.

      Delete
  11. Anonymous4:58 pm

    Hello, i think that i saw you visited my website so i
    got here to return the desire?.I am attempting to find
    things to improve my site!I suppose its ok to use a few of your
    ideas!!

    ReplyDelete
    Replies
    1. Dear Anonymous, I might have visited your site clicking the Stats but since you post as Anonymous, I don't know which site is yours ;-)

      Feel free to use ideas, that is a huge compliment. As long as you do not use my name, stories or the photo's: all licensed!! You may post a link to my Blog of course.

      Wishing you success!

      Helen

      Delete
  12. Anonymous5:57 pm

    Yes! Finally something about loss product
    choices.

    ReplyDelete
  13. Anonymous10:32 am

    Real clean web site, regards for this post.

    ReplyDelete
  14. Anonymous9:25 pm

    First of all I want to say awesome blog! I had a quick
    question which I'd likee to ask if you don't mind. I waas interested to find out how yoou center
    yourself aand clear your mind before writing. I've hadd a hard time clering my mind in getting my ideas out there.
    I do take pleasure iin writing but it just seems like the first 10 to 15 minutes are generally wasted simply just trying to figure out how
    to begin. Any suggestions or tips? Cheers!

    ReplyDelete
    Replies
    1. Dear Anonymous,

      Thank you for your kind words!
      Of course I don't mind questions and I hope I can help.

      Lovely to know you also take a pleasure in writing.
      I think it will differ per person or even per story how to begin. With short stories I usually have the end in my head, write it down and work from there. But sometimes it is the middle part The title is often the last part I think of.

      The best is to sit down, write what you want and work from there. And sometimes the story goes a totally different direction than I had planned and I accept that, I let it tell its own story. An Example is 'Last Performance'.

      Try to live the emotions of your personage without becoming it :-)

      Hope this helps. Good luck and I would love to hear how your writing is going.

      Helen

      Delete
  15. Anonymous10:22 pm

    Yeah bookmaking this wasn't a speculative determination outstanding post!

    ReplyDelete
  16. Anonymous2:29 pm

    Very nice article, totally what I needed.

    ReplyDelete
  17. Anonymous9:25 am

    Hi there, I desire to subscribe for this weeb site to obtain hottet updates, therefore whede can i do iit please help.

    ReplyDelete
  18. Anonymous11:49 pm

    Whhat i don't understood iss in reality how you are
    now noot actually a lot more well-appreciated than yyou may be now.
    You are very intelligent. You understawnd theresfore significantly with regards
    to thhis matter, made me in my view believe iit from a lot of various angles.
    Its like men and women aren't interested until itt is
    one thing to accomplish with Girl gaga! Your personal stuffs nice.
    Always handle it up!

    ReplyDelete