Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is a new Skype worm that is spreading very fast and the detection rates are very low: analisys

It creates groups from all your contacts and sends "haha foto" followed by a link.

At the time of writing this the anti-virus does not detect it - samples have been submitted.

Any idea how can this be blocked ?

share|improve this question
It's not a virus, it's a worm. – Alan B Feb 27 '12 at 11:14
Signatures are the weakest link in AV vendors scheme, all you have to do is buy a new version of your packer and your file is clean again. – Shadok Feb 27 '12 at 11:21
I corrected the post. – Dragos Feb 27 '12 at 13:27
Try – Moab Feb 27 '12 at 18:11
@Moab: Your link points to some software for starting infected computers and removing malware from them. It does not block the acquisition of malware. Source: Paragraph 2 of your link's destination. – Eroen Feb 27 '12 at 20:54

Unless I'm mistaken, this piece of malware requires the soon-to-be infected party to somehow download and execute some file sent to them through Skype in order to be effective.

Effective countermeasures should then include:

  • Disabling Skype, external network access, system user accounts & c.

  • Migrate to an operating system that is not affected by this malware.

  • Disabling users not on contact list from contacting users on Skype. This was at least possible a few years ago, but is obviously weak and requires that nobody on the contact lists get affected.

  • Educating users in basic computer usage, and including the importance of not downloading and executing files without a reasonable purpose behind doing so.

share|improve this answer
"When a Skype user receives the chat message - either from their Skype contacts or users not on their contact list - it includes an internet link. Instead of a .jpg image that it seems to point to, the link actually leads to a virus file. By clicking on the link, the Windows Run/Save dialog box will pop up, asking for permission to save or run a .scr file. This is the virus file and should not be downloaded or run. If the user accepts the file, however, their Windows PC will be infected. The worm uses Skype's public Application Program Interface (API) to access the PC.”. – Moab Feb 27 '12 at 18:13… – Moab Feb 27 '12 at 18:13
Less editor wrongified version of your link: (link ). It refers to a completely different malware, reported in 2007. However, my advice above applies equally well to that. – Eroen Feb 27 '12 at 20:46
Just posting to show how easy it is to be infected, malware changes but tactics don't. – Moab Feb 27 '12 at 21:49

It would depend on how the virus operates but depending on your level of concern in terms of how highly you rate risk of infection for you or your network users (and the severity of such infection) I would suggest disabling Skype until your antivirus utility gets the signatures for this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.