Wednesday, December 20, 2006

Skype Trojan Horse on the loose, but removal’s easy

Russel Shaw reports:
Yesterday Websense Security Labs reported that there was a potential Worm propagating via Skype (see:
http://www.websense.com/securitylabs/blog/blog.php?BlogID=101). After investigation we have discovered that this is not a self propagating worm and is actually a Trojan Horse.

After discussions with the very helpful Skype security team, the behavior of this Trojan using the Skype API is as per the specifications of the API. The end-user who is running Skype does get notified that a program is attempting to access it and must acknowledge it.
*there is no vulnerability in Skype at this time that has been uncovered*
For more details on the Skype API see
https://developer.skype.com/Docs/ApiDoc/Overview_of_the_Skype_API

At the time of this alert the websites that were used to download the Skype API code and the site that is used to download new copies of the Trojan were both down.
Websense says the original infections appear to be occuring in the Asia Pacific region, especially Korea.


According to Symantec, here's what happens when this piece o' crap launches executes:

1) Searches the registry for the location of the Skype application.


2) Displays the following message and then exits if it cannot find the registry: Error!I could not find Skype !


3) Executes the Skype application and displays the following message if it finds the registry:Warning!Allow this program in skype!

4) Queries Skype for random users every 3 minutes.


5) Starts the Skype application and sends the following message to the users:Check this! [http://]marx2.altervista.org/surpr[REMOVED]

All that said, this appears to be some pretty weak malware. Symantec says so.
Removal via Symantec's daily virus definition update fixes this…

9 comments:

  1. Anonymous8:56 pm

    Hey There. I found your blog using msn. This is a very well written article.
    I will be sure to bookmark it and return to read more of your useful information. Thanks for the post.
    I'll definitely return.

    ReplyDelete
  2. Anonymous10:26 pm

    Tһank you for tһe gߋod writeup. It in fact was a amusement account it.
    Look ɑԁvɑnced to more added agreeable from yoᥙ!
    By the way, how can we communicate?

    ReplyDelete
    Replies
    1. Thank you!

      You can contact me with the contact form in the right side bar. But please note that I do NOT blog about Skype any more!

      Helen

      Delete
  3. Anonymous12:16 pm

    Whoa! This blog looks just like my old one! It's on a totally
    different subject but it has pretty much the same layout and
    design. Great choice of colors!

    ReplyDelete
  4. Anonymous4:45 am

    I am forever thought about this, appreciate it for posting.

    ReplyDelete
  5. Anonymous10:27 pm

    Very interesting info!Perfect just what I was searching for!

    ReplyDelete
  6. Anonymous10:02 pm

    Hello, There's no doubt that your site might be having internet browser compatibility problems.
    When I take a look at your web site in Safari, it looks fine however, when opening in I.E., it has some overlapping issues.
    I merely wanted to provide you with a quick heads up! Aside from that, fantastic website!

    ReplyDelete
  7. Anonymous4:18 pm

    Some truly marvellous work on behalf of the owner of this site, utterly great subject material.

    ReplyDelete