19 December 2006
More Information on the 'Skype Worm'
As more is being learned about this worm, we find out that it is not targeting Skype directly but is spreading through links and people downloading the sp.exe file. It affects all Windows computers from Win95 to XP. Luckily it is rather easy to remove and easy to stop which makes it do very little damage.
When a computer with Skype is infected with this it will give a warning message before running that says,
"Warning!
Allow this program in skype!"
If users do not allow the program to run then it cannot spread. That doesn't of course mean that it cannot find information on your computer, it just won't move to the next random Skype user.
When it does find another random user it will send a message that says:
"Check this! [http://]marx2.altervista.org/surpr"
This URL has been removed by now which gives a lot more protection to users in the spread of the worm.
If you have been infected, it is not so difficult to remove.
The first step is to disable the system restore feature in Windows ME and XP. Then with an updated antivirus definition file, do a complete system scan.
For those who aren't sure how to disable the system restore feature:
From the start menu, right click 'My Computer' then select properties. From there you will see a 'System Restore' tab. Inside that tab will be a option to 'Turn off System Restore' or something very similar. After doing that apply the changes and confirm it then hit OK. At this point you are ready to scan for the virus.
When a computer with Skype is infected with this it will give a warning message before running that says,
"Warning!
Allow this program in skype!"
If users do not allow the program to run then it cannot spread. That doesn't of course mean that it cannot find information on your computer, it just won't move to the next random Skype user.
When it does find another random user it will send a message that says:
"Check this! [http://]marx2.altervista.org/surpr"
This URL has been removed by now which gives a lot more protection to users in the spread of the worm.
If you have been infected, it is not so difficult to remove.
The first step is to disable the system restore feature in Windows ME and XP. Then with an updated antivirus definition file, do a complete system scan.
For those who aren't sure how to disable the system restore feature:
From the start menu, right click 'My Computer' then select properties. From there you will see a 'System Restore' tab. Inside that tab will be a option to 'Turn off System Restore' or something very similar. After doing that apply the changes and confirm it then hit OK. At this point you are ready to scan for the virus.
Labels: skype, vulnerability, windows
