Home / malwarePDF  

IM-Worm:W32/Skipi.A


First posted on 12 September 2007.
Source: SecurityHome

Aliases :

IM-Worm:W32/Skipi.A is also known as Worm.Win32.Skipi.A.

Explanation :

IM-Worm:W32/Skipi.A is an Instant Messaging worm that spreads via Skype Chat.

It sends short text messages with URLs for two different websites. After redirection, the recipient is prompted to download a copy of the worm with an .SCR extension.

After being run the worm displays an image, usually "Soap Bubbles". This image is a part of the Windows OS (wallpaper).

It drops the following copies of itself:


The worm then installs itself to the system and creates several startup keys for itself in the Registry:


It also creates the following registry key:


This malware terminates processes with the following names:


This malware communicates with Skype using the API "SkypeControlAPIDiscover". When properly communicated with Skype, it sets the status of the Skype User as DND or "Do not Disturb". It also sends messages to all of the Skype Contacts on the infected user's computer. Below are the possible messages in Skype Chat:


It includes a link that points to any of the following URLs. The links below point to copies of the malware:


The worm also modifies the Windows HOSTS file in order to block access to anti-virus vendor sites. It modifies the HOSTS file in a way that when the user access an anti-virus site, it will be redirected to a random IP address.

Here are the related antivirus sites:


It also attempts to check connectivity and to possibly download a file from the following sites:


The worm also copies itself to all available removable drives with the name of "game.exe". It also creates an autorun.inf so that when the removable drive is accessed, the malware will run.

Last update 12 September 2007

 

TOP

Malware :

Family: