CDRInfo Forum CDRInfo Forum

Forums  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Photo Gallery  Member List  Search  Calendars  FAQ  Ticket List  Log Out

New Skype Virus Confirmed   Logged in as: Guest
Viewers: 570 You can click here to see Today's Posts | Most Active Topics | Posts Since Last Visit
  Printable Version
All Forums >> [News Around The Web] >> Security News >> New Skype Virus Confirmed Page: [1]
Login
Message << Older Topic   Newer Topic >>
New Skype Virus Confirmed - 9/11/2007 3:52:15 PM   
icube001


Posts: 5429
Joined: 11/6/2006
Status: offline
Symantec and F-Secure have both confirm the existance of a new worm that is affecting users of Skype for Windows.

The worm is called "w32/Ramex.A". Users whose computers are infected with this virus will send a chat message to other Skype users asking them to click on a web link that can infect the computer of the person who receives the message.

The worm is also known as "WORM_SKIPI.A [Trend]," and "W32/Pykse.worm.b" [McAfee].

After being run the worm displays an image, usually "Soap Bubbles". This image is a part of the Windows OS (wallpaper), according to F-Secure. The worm then installs itself to the system and creates several startup keys for itself in the Registry. When active, the worm sends messages to all Skype Contacts of the infected computer's user.

Messages usually contain a short text and a URL pointing to the worm's file. The worm also modifies the Windows HOSTS file in order to block access to anti-virus vendor sites. As a part of the payload, the worm terminates processes belonging to anti-virus software. The worm also copies itself to all available removable drives with the name of "game.exe".

There are two ways to get rid of the worm: the normal way and the techhead way. Most users should not attempt to edit their computer's registry manually. For most people, downloading and/or updating their anti-virus software, and scanning their computer to detect and remove the worm, is the way to go.

Expert users - and only expert users - who know what they're doing can also remove the worm manually.

- Restart the PC in safe mode
- Run regedit
- Go to HKLM/software/microsoft/windows/currentversion/runonce find entry with mshtmldat32.exe. Delete this entry.
- Go to Windows\System32 directory and delete following files: wndrivs32.exe, mshtmldat32.exe, winlgcvers.exe, sdrivew32.exe
- Go to windows/system32/drivers/etc
- Find file hosts
- Open it with notepad, ctrl+a and delete all entries (this will resume your antivirus updates), save, close.
- Restart the PC.
Post #: 1
Page:   [1]
All Forums >> [News Around The Web] >> Security News >> New Skype Virus Confirmed Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Forum Software © ASPPlayground.NET Advanced Edition 2.4.5 ANSI

0.078