Trojan downloader alert
By
Villu Arak on February 27, 2008 in Trojans and viruses.
We’ve seen some instances where a chat message masquerading as a link to an image file instead leads to a piece of malware. The chat messages may look similar to this:
If you receive something like this through a Skype chat message, do not be alarmed. Instead, ignore it and block the sender. Do not click on the link or open the file that the link points to.
When executed, however, the Trojan downloader creates a Microsoft Studio Files folder in the Program Files directory, populating it with a copy of itself (lsass.exe) as well as a script file (vcdg.bat) that helps it bypass the Windows firewall. The program also changes the Windows registry to enable automatic execution upon Windows startup and to bypass the Windows firewall. Following these steps, the program downloads files into the infected system.
The Skype security team would like to remind users to keep their antivirus software updated and maintain a skeptical eye toward chat messages that don’t seem quite right and contain internet links, whether they appear to come from friends or total strangers.
