[Public Service Announcement] Nasty Skype virus going around.

Started by: GrimmtheReaper | Replies: 21 | Views: 1,970

GrimmtheReaper
2

Posts: 1,918
Joined: Feb 2013
Rep: 10

View Profile

Mar 25, 2014 8:29 PM #1179910

There is a nasty virus going around on skype and I thought I should spread the word. This ain't copypasta, like most hacker warnings, and Ikarhan had gotten contacted by an infected computer. Fortunately the skype status had said "WHAT EVER YOU DO DON'T OPEN THAT" so he never accepted the file.

A user on DeviantArt named Franz32 encountered the virus and finally managed to contain it. He is working on taking it apart to see how it ticks. Here's what he said on the matter:

Quote from Franz32
The virus will come to the victim through a contact whose PC was infected.
It will say a message like
"when was the last time you saw this photo?
[suspicious URL ending in your Skype username] :) (Smile)"

Clicking the link will download a file labeled "telegram (3).zip" to the victim's computer, containing "whatsapp.scr".
After the file is opened it will use the victim's Skype client to continue spreading the virus in the forementioned manner.
Effects other than spreading are unknown, but my infected friend is having (possibly unrelated) problems with their video card as well as internet browser problems.

**UPDATE**

There is confirmation that whatsapp.scr contains Trojan.Ransomware.ED!
This is what YooCare says about this trojan.

"Once installing itself in the computer successfully, Trojan.Ransom.ED begins to change system settings, simultaneously adding malicious files and registry entries to the target system forcedly, which makes it possible to avoid troubles and remain active in the backdoor to control the infected computer easily. Your computer will be very strange. The currently running program or even the computer will suddenly shut down without prior notice to you. You know, too many abnormal shutdowns can cause not only system damages but also hardware damages. It is also able to hide your important files, slow down the computer and even lead to system collapse. Moreover, other viruses will be injected into the infected computer, which will further damage the computer. With the extra help from these viruses, this Trojan can sleep without any anxiety. It is capable of monitoring your computer using traces and transmitting the gathered information back to the virus makers. No one can predict how they will deal with the information. Therefore, you must remove the Trojan horse as soon as possible since time is pressing. But it is hidden deeply in your computer by pretending to be a part of the system. The stiff antivirus programs are difficult to find out all its malicious components. Thus, manual removal is the most effective method."

Here is a link to the article and removal instructions. http://blog.yoocare.com/trojan-ransom-ed-how-to-remove/ [Just scroll down a bit.]

Apex-Predator
2

Posts: 4,296
Joined: Mar 2012
Rep: 10

View Profile

Mar 25, 2014 8:31 PM #1179913

Thanks for alerting the community :)

Charry
2

Posts: 2,260
Joined: Jul 2013
Rep: 10

View Profile

Mar 25, 2014 11:04 PM #1179946

This has happened before, the virus mentioning your avatar, rather than a photo. I don't understand why anyone would trust a link given to them by somebody they don't know.

Hydra
2

Posts: 1,486
Joined: Oct 2012
Rep: 10

View Profile

Mar 25, 2014 11:23 PM #1179951

woah thanks for telling us this even though if i did get the link I would never click it

GrimmtheReaper
2

Posts: 1,918
Joined: Feb 2013
Rep: 10

View Profile

Mar 26, 2014 2:00 AM #1180020

Quote from Charry
This has happened before, the virus mentioning your avatar, rather than a photo. I don't understand why anyone would trust a link given to them by somebody they don't know.

Because of how skype works, you would only get the message from one of your contacts. That means you would get it most likely from someone you know.

Sharp
2

Posts: 3,208
Joined: Aug 2012
Rep: 10

View Profile

Mar 26, 2014 9:58 PM #1180525

Yeah, this has happened before. I even made a thread about it a long time ago.

Scarecrow
2

Posts: 9,168
Joined: Oct 2005
Rep: 10

View Profile

Mar 27, 2014 1:05 AM #1180578

soooo what you're saying is... don't open questionable screensaver files that are in suspicious zip files that you didn't intentionally download?

thanks for the solid advice

Hewitt

Posts: 14,256
Joined: Jul 2012
Rep: 10

View Profile

Mar 27, 2014 1:07 AM #1180580

It's like we're back in 1993

Scarecrow
2

Posts: 9,168
Joined: Oct 2005
Rep: 10

View Profile

Mar 27, 2014 1:09 AM #1180581

i think the whole point of these viruses is that if you're stupid enough to run them you deserve to have your computer buttfucked by a trojan

GrimmtheReaper
2

Posts: 1,918
Joined: Feb 2013
Rep: 10

View Profile

Mar 28, 2014 3:00 AM #1180984

Of course, I think CryptoLocker is more insidious, and it came around September last year. It's some right nasty ransomware, but the very best method of ridding yourself of it is preparation. Since CL won't run VMs, that makes reverse engineering difficult on a windows system. Since it doesn't affect Macs (yet) it could be more safely decompiled. Here's my notes on that matter

This is a rather long bit of text (Click to Show)

TL;DR: Take the bloody thing apart to see how it ticks, infect the thing with a counter-virus, and use their own malware against them.

MiniMan
2

Posts: 11,846
Joined: Dec 2005
Rep: 10

View Profile

Mar 28, 2014 7:36 AM #1181051

Quote from Scarecrow
soooo what you're saying is... don't open questionable screensaver files that are in suspicious zip files that you didn't intentionally download?

thanks for the solid advice

This sums up my reaction when I find out people actually fall for things like this (And aren't 80 years old)

Hewitt

Posts: 14,256
Joined: Jul 2012
Rep: 10

View Profile

Mar 28, 2014 8:25 AM #1181065

Quote from GrimmtheReaper
TL;DR: Take the bloody thing apart to see how it ticks, infect the thing with a counter-virus, and use their own malware against them.

Your entire knowledge of computer science is based on hollywood

GrimmtheReaper
2

Posts: 1,918
Joined: Feb 2013
Rep: 10

View Profile

Mar 28, 2014 1:31 PM #1181157

Quote from Hewitt
Your entire knowledge of computer science is based on hollywood

Negative. Reverse-engineering a virus is very common in discovering methods to prevent, remove, and counteract viruses. Injecting software into the ransomware's coding that latches onto data sent to the C&C server it relies on could allow the author's computer to be infected when he/she connects to it. From there, ALL private keys for decrypting targeted files can likely be located when the author sends one from its location on his computer. It has to be assumed that the private keys are named in a specific manner that indicates what computer it goes to, as the ransomware relies on interaction from the author to send the decryption key when the ransom is paid. By comparing patterns in each of the private keys, it would theoretically be possible to make a keygen that uses the public encryption key listed by the ransomware's notification window to create the working decryption key.

MiniMan
2

Posts: 11,846
Joined: Dec 2005
Rep: 10

View Profile

Mar 28, 2014 1:42 PM #1181162

Quote from GrimmtheReaper
Negative. Reverse-engineering a virus is very common in discovering methods to prevent, remove, and counteract viruses.

I wanted to stop reading here because I knew the rest of that paragraph was going to be like punching myself in the head.

I didn't stop.

I regret it.

GrimmtheReaper
2

Posts: 1,918
Joined: Feb 2013
Rep: 10

View Profile

Mar 28, 2014 3:50 PM #1181208

Quote from MiniMan
I wanted to stop reading here because I knew the rest of that paragraph was going to be like punching myself in the head.

I didn't stop.

I regret it.

Simple version: THe guy who made the virus has to send the key to unlock your stuff. Sneak a keylogger/spyware into his computer and you can steal the keys.