Beware: Malware Through Skype

[fencore]

URGENT. Read the following and be aware of a malware link circling its way via Skype PMs.

Edit: More information in the second post. If you have it, read to the second post to learn how to remove it.

Excerpt from Faction Leader Chat:

********** VIRUS ALERT ***********
Please be aware that a worm is circulating through some of Discovery's Skype circles, and it could make its way to you.
An infected computer sends you a message saying "lol is this your new profile pic?" with a goo.gl link with your name in it. DO NOT CLICK ON THIS LINK.
Good news is, it only links to a .zip file. If you have opened the .zip, DO NOT RUN THE EXE. DELETE THE FILE.
If you have clicked on the exe and ran it, immediately perform a virus scan, a boot scan if possible. Thank you.
*********************************

Normal safe internet stuff, guys. Be sure to know what the links you're clicking are leading to.

[Alley]

Copy paste from my flood thread

A skype virus, worm type is currently spreading among the discovery playerbase.

Someone will send you a message with as content :

lol is this your new profile pic? http://goo.gl/**[CENSORED]**?img=**[YOUR SKYPE USERNAME]**

DO NOT CLICK IT FOR THE LOVE OF GOD. It will make you download a zip archive that contains an exe. Just by opening the archive it will trigger the thing and it's going to be one hell of a mess to remove it.

DO NOT EVER OPEN SUSPICIOUS FILE ARCHIVES
We keep saying it again and again all the time, if something looks fishy, doesn't look like what the guy would usually write and talks about a picture of yourself/avatar with a link next to it DON'T FALL FOR IT.

Some community members fell for it already and spreading it to other people.

== REMOVAL GUIDE ==

Found it on the interwebs, apparently this virus has been going since 2010 and didn't change much except for the sentence. It seems to be same one from what we have seen and heard from infected people so far.

http://www.coolbuster.net/2012/03/skype-...emove.html

Aparently it installed a host link to my computer even though I never ran the exe.

Another addition to the removal process. Go to windows/system32/drivers/etc and find the file named
"hosts". Open it with notepad, press ctrl+a to select everything and delete the contents.

That was the only connection it had to my computer, none of the exe's or anything. Make sure you do a full removal as well, check everything.

And sorry again to all of those who got a message from me.

---

Alley was right.

[Ninefour]

Thanks for the warning!

---

retired

[Junes]

Had already one contact sending me this link. AntiVir software immediately detected suspicious content. Lame malware.

[Vernandos]

Thanks for the heads up!

---

[Jim.Solo]

I've actually had one this morning. I think I got away with it; I was stupid enough to click the link but when it downloaded the file and I saw it had an EXE in it, the alarm bells started ringing.

The odd thing is, Kaspersky AV doesn't detect anything when I scan it!

Cheers guys.

---

[phileditin51]

It's a shame when people do this kind of trick, but at least Skype players know now, nice job, too late for some no doubt.

[Disco]

Saw the skype message earlier today. Glad I didn't click it.

---

[mwerte]

Well that's what I get for internetting before I normally wake up...

---

[AshHill07]

I've posted an Alert in SFC| skype. Don't think its got around to us yet though so it may be a non-issue.

---

\\ CDR David Roberts \\ CAPT Steven Eversman \\ VADM Ash Hill // RDML Chris Murray // CDR Mick Connors //
\\ SFC| Patrol-7 \\ SFC| LNS-California \\ SFC| LNT-Century // SFC| LNS-San.Francisco // SFC| Patrol-5 //