The IRCbot variant is spammed via e-mail, with the attached file disguised as the newest release of Skype, version 1.4.

Gregg Keizer, Contributor

October 17, 2005

1 Min Read

A Trojan passing itself off as the Skype voice-over-Internet (VoIP) client is making the rounds, security firm MessageLabs warned Monday.

The IRCbot variant is spammed via e-mail, with the attached file payload disguised as the newest release of Skype, version 1.4, said MessageLabs. Skype Technologies released the 1.4 client at the end of September.

"For further details see the attached document," read the e-mail after an opening spiel touting Skype's features.

Users who launch the attached file see a fake dialog box on their screens; the dialog displays a phony installation error. In fact, the Trojan is installing itself, shutting down access to Windows Update, and connecting to an IRC server for further instructions from its handler.

"This is the first case that we've seen that specifically mentions Skype," said Maksym Schipka, a senior anti-virus researcher at MessageLabs, in a statement. "It's another example of how malware writers are quickly exploiting new releases of popular software applications in order to spread their malicious payloads."

About the Author(s)

Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.

You May Also Like


More Insights