Skype receives mass virus

[Витаутас. Частный детектив г. Вильнюс. Литва]

Skype receives mass virus
10/08/2012
A mass mailing via Skype and social networks has been detected, leading to the infection of Windows computers with the Worm.NgrBot worm. The danger of the threat is compounded by the fact that users receive a malicious link on behalf of their authorized contacts.
An interesting social Trojan was discovered in Runet, distributed via Skype and through social networks.
Apparently, the first threat was described by the Belarusian antivirus company Virusblokada on October 4, 2012. The next day, the existence of the threat was confirmed by domestic antivirus developers Kaspersky Lab and Doctor Web.
According to a post on the Virusblockada blog, infection with a newly discovered virus occurs after clicking on the link received on Skype, and the victim receives a message with a dangerous link from one of his authorized contacts.
A dangerous link is accompanied by the message "Is this your new profile avatar?" or "ey eto vasha novaya kartina profil '? [nickname on Skype]." When you click on the link, a ZIP archive with a malicious executable file with the extension .EXE is loaded into the system.
The file is a relatively long-known multifunctional network worm Worm.NgrBot (or Dorkbot) that includes an infected computer in a botnet and attracts it to DDoS attacks.
In addition, Worm.NgrBot is able to steal passwords both from Letitbit, Sms4file, Vip-file and from mail, legal services and social networks (YouTube, Gmail, Facebook) and block the computer’s access to the sites of anti-virus companies.
The company notes that, in addition to sending messages on Skype, Worm.NgrBot is able to distribute itself also through messages on the social networks Vkontakte and Facebook, via Twitter, as well as via flash media.
There is no reliable data on the extent of the infection and the distribution area of Worm.NgrBot via Skype, however, the geography of detection and the specifics of the suspicious message accompanying the malicious link allows us to judge that the current epidemic originated in the CIS countries.
The pioneer of the new Virusblockad threat warns users against clicking on suspicious links and, in order to avoid the further spread of the Trojan, calls for disabling the Skype management feature for other programs. This can be done in the advanced settings menu of Skype, clearing the item "Access control software interface".
Virusblockada notes that since the Worm.NgrBot Trojan is hidden from detection by standard Windows tools, it will require the use of special utilities to detect and remove it.
Doctor Web, a Russian developer of security tools, believes that updating the virus databases is enough to remove the trojan.
https://www.bezpeka.com/en/news/2012/10/ ... -worm.html

 

[Андрей Захаров]

Vytautas, thanks for the info))) Just today something crashed the computer ...

 

[Частный детектив. Владивосток.]

Thank ! He scattered his on skype ...)))

 

[НСК-СБ]

Vytautas, thanks for the info! I took advantage of the recommendations!

 

[Патрушев Михаил Владимирович]

Thanks for the info!!!

 

[Магат]

Thank you so much, take note!

 

[Симферополь]

Vytautas, thanks! I would read your topic yesterday, today I wouldn’t open a trojan on Skype ... And the truth came from my friends, to whom it got the same way, only my antivirus seemed to work on time ...

 

[Частный детектив Нижний Новгород]

Thanks Vytautas.

 

[Бюро Рысь]

Thank you!

 

[Растаман]

Thank!