Slashdot Mirror

← Back to Stories (view on slashdot.org)

Skype Worm Infects Windows PCs

Posted by kdawson on from the footsteps-of-msn-and-yahoo dept.

walterbays writes with news of a worm spreading to Windows PCs through Skype's IM. The worm is variously called Ramex.a and Pykspa.d. A poster on a Skype forum explains how to remove it. "After hijacking contacts from an infected machine's Skype software, it sends messages to those people that include a live link. Recipients who blithely click on the URL — which poses as a JPG image but is actually a download to a file with the .scr extension — wind up infected."

12 of 127 comments (clear)

  1. Worm? by Hatta · · Score: 4, Insightful

    Recipients who blithely click on the URL -- which poses as a JPG image but is actually a download to a file with the .scr extension -- wind up infected.

    I'm sure I won't be the first to point out that such an attack vector is not a worm.

    --
    Give me Classic Slashdot or give me death!
    1. Re:Worm? by Anonymous Coward · · Score: 5, Funny

      Given your position of first post, I can't see how you could be anything but the first to point out this.

    2. Re:Worm? by Bill,+Shooter+of+Bul · · Score: 4, Funny

      That is a good point, and I must admit I thought that as well ... at first. Then I started thinking, How long is something really first? Is something first always first? Like the first European to visit the Americas, Columbus. He was first, but only for 400 odd years before we discovered that the vikings were the first. Also, one can never be so certain that time travel will never exist. Therefore, all of our first records in any given field may be only temporary, before some one from the future comes back and does it first.

      I applaud the gp's modesty, and four dimensional thinking. I think we should all be a little more considerate of our resources, both natural and produced, in light of the fact that they may belong to someone else before us, in the future.

      --
      Well.. maybe. Or Maybe not. But Definitely not sort of.
    3. Re:Worm? by Doctor-Optimal · · Score: 4, Funny

      Ooh, a lesson in not changing history from mister "I'm-my-own-grandpa"!

      --
      New punctuation update "~" (no quotes) at the end of a line to indicate sarcasm. ~
  2. F-Secure info by CXI · · Score: 4, Informative

    F-Secure has information as well.

  3. Skype itself is blameless by ZwJGR · · Score: 5, Insightful

    Skype itself is (mostly) blameless, how can they be expected to protect users from this sort of attack (perhaps by pointing out to users that the link/download they're clicking on is a screensaver exe..., but Windows ought to tell you that anyway...)
    Naming it a worm is a minor overstatement as well.
    It propagates by user incompetence, not by a technical flaw...

    These sort of malware executables circulate on email lists (and I daresay, other IM networks) already, so it's no surprise that Skype has "joined the club" of being big enough to attract unwanted attention...

    --
    There is no psychiatrist in the world like a puppy licking your face - Ben Williams
    1. Re:Skype itself is blameless by jimicus · · Score: 4, Insightful

      It propagates by user incompetence, not by a technical flaw...

      If the last 8-10 years have taught the IT industry nothing else, we should at least be well aware by now that basing your security on "user never does anything stupid" is a pretty effective way to ensure that the user's system will be emailing everyone and his dog adverts for Geniun Vigara!!!111 (sic) by the end of the day.

    2. Re:Skype itself is blameless by gowen · · Score: 5, Insightful

      Skype itself is (mostly) blameless
      You what? Their program runs executable content from a URL without a warning or asking for confirmation. That's insanely bad design.
      --
      Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
  4. Re:Software diversity is a good thing. by Opportunist · · Score: 4, Insightful

    And how? By not implementing a messenging system the moron user can click and infect himself?

    Where's Skype to blame if someone gets a link sent and clicks it without even trying to see what's behind it?

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  5. FIXED by Anonymous Coward · · Score: 5, Funny

    s/some of the //

  6. Re:Lovely by recoiledsnake · · Score: 4, Informative

    It does not "inject code" into Explorer any more than Notepad injects code into Explorer to run itself. An "infected user" is probably not the right person to listen to in such technical matters. FSecure has complete details on it if you're really interested here

    --
    This space for rent.
  7. Re:Microsoft's fault? by recoiledsnake · · Score: 4, Insightful
    I fail to see how that behavior makes a difference here. The user clicks on a link that ends in .JPG, and the browser asks him to run or save an SCR file. No hiding the extension is involved here. If the user runs it, BAM. If he saves it, THEN he or someone else would not be able to see the extension and would run it(Though I think XP SP2 pops up a warning about it being a file from the internet zone, not sure if the full filename shows up in the warning though).

    Hiding the extension is a very most annoying thing though, it's the first setting that I change on a new install of Windows.

    --
    This space for rent.