Warezov worm fiends target Skype

["QSCANFSCTL" <QSCANFSCTL@xxxxxxxxxxx>]

Warezov worm fiends target Skype
By John Leyden
Wednesday 28th February 2007

The authors of the prolific Warezov worm are targeting users of Skype.

Warezov variants first cropped up in September 2006 and spread in the
attachments of email messages posing as security fixes. Instead of arriving
via an email attachment, the latest variant of the worm spreads using a
bogus Skype chat message asking users to click on a link, which points to a
hacker-controlled website hosting malicious codes.

The plausibility of the attack is increased because infected messages likely
come from a target's list of known contacts, though the abrupt dialogue it
generates might trigger a few alarm bells.

Some older Warezov variants used other Instant Messaging clients in a
similar fashion, but this variant (Warezov-LY) is the first to use Skype,
anti-virus firm F-secure reports.

This Warezov family of worms is notable for the rate at which new variants
of the malware are being produced, making detection and removal a big
challenge for anti-virus vendors who've had to update anti-virus signatures
rapidly as a result.

Read About It
Information about W32/Stration@MM is located on VIL at:
http://vil.nai.com/vil/content/v_140419.htm

Detection
This particular variant of W32/Stration@MM was first discovered on March 1,
2007 and detection will be added to the 4975 dat files (Release Date: March
2, 2007).

If you suspect you have W32/Stration@MM, please submit a sample to
<http://www.webimmune.net>

Mike Grant
Bytware, Inc.
775-851-2900

http://www.bytware.com

CONFIDENTIALITY NOTICE:  This e-mail message and any attachment to this e-mail 
message contain information that may be privileged and confidential.  This 
e-mail and any attachments are intended solely for the use of the individual or 
entity named above (the recipient) and may not be forwarded to or shared with 
any third party.  If you are not the intended recipient and have received this 
e-mail in error, please notify us by return e-mail or by telephone at 
775-851-2900 and delete this message.  This notice is automatically appended to 
each e-mail message leaving Bytware, Inc.