<<<
NEWS FROM THE LAB - Monday, September 10, 2007
>>>
 

 
Seeing bubbles? Might be the Skype worm... Posted by Mikko @ 22:37 GMT

A Skype worm is going around. It's spreading via Skype's instant-messaging functionality, Skype Chat. Users receive English (or, in some cases, Lithuanian) messages from their friends with links to innocent-looking URLs along these lines:

   http://www.myimagespace.net/erotic-gallerys/[removed]/dsc027.jpg
   http://www.fakme.org/erotic-gallerys/[removed]/dsc027.jpg



Although the links look like they are pointing to an image, they are not. Instead, they point to a page that will try to download a program called DSC027.SCR to your machine.

We've seen at least two different versions of this malware so far. When run, they both display one of the default built-in wallpapers in Windows (Soap Bubbles.bmp):

Skype Bubbles

For more information, see our malware description and follow the Skype Heartbeat blog.