Update August 2019. What is Skype virus? Because of their popularity and large adoption by users worldwide, applications such as Skype and Facebook are targeted by malware authors quite often. This article is dedicated to Skype malware, often referred to as simply “Skype virus”. Keep in mind that Skype virus is a generic name for all types of Skype-related malware.
|Short Description||Skype Virus is a generic name for various malware threats that are delivered over Skype.|
|Symptoms||The user may be affected by a malicious ad served over Skype, his account may be hijacked, etc.|
|Distribution Method||Malicious links and ads sent via Skype, pages hosting malware|
See If Your System Has Been Affected by malware
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Skype Virus.|
Depending on the purpose of attackers, some Skype viruses are targeting user accounts and hijacking them, and others are using the application to infiltrate the operating system. Continue reading to learn more about the various types of Skype viruses and how to remove them, or better – evade infection.
Goo.gl Skype Virus: Technical Overview
One of the most common Skype viruses is the so-called Goo.gl Skype virus. It is also one of the oldest pieces of such malware. As it turns out, the malicious campaigns that deliver goo(.)gl spamming URLs in Skype are still active.
Users on various forums report to receive strange messages from their Skype friends. The messages usually contain pictures and shortened goo(.)gl links. When clicked, these spamming URLs land on suspicious web pages that offer a download of a malicious file. Once such data is saved on the system, it may cause severe malware infections or serve as a gateway for further threats. Users are highly advised not to interact with these links.
In case you have clicked on such a compromised link, it is a good idea to run a scan with an advanced anti-malware tool as the malware may have sneaked into the system.
Goo.gl Skype Virus: Distribution Methods
This Skype virus relies on some clever distribution techniques. Initially, the malware was distributed via a web link using goo(.)gl services, such as the following one, along with a luring message:
[skype.user]: haha you wouldn’t believe it https://goo(.)gl/lLGdM?foto=user
The web link then redirects to a 4shared, hotfile or other file-sharing services:
Then, the link may download a .Zip or another type of file containing the same malware. Symantec researchers have reported two main malware pieces associated with this Skype virus:
After one of the above malicious bots has been downloaded and activated on the compromised computer, it would immediately connect to a C&C (Command and Control) server. After connecting to the server, the malware may download other malware types such as:
- Spam Bots;
- Botnet kits.
It should also be noted that attacks of this character use obfuscators so that the malware remains undetected for longer times on infected computers. Attackers are typically using reputable services to spread malicious files and using affected users to spread spam messages to people in their contact list on Skype.
Skype.exe Virus: Technical Overview
Malware is known to use legitimate files that belong to legitimate programs. Such is the case with the Skype.exe virus. According to Hybrid Analysis, the malicious file is able to read terminal service related keys that may be RDP related. It also acts as spyware, being able to access sensitive information from local browsers, open the clipboard and retrieve keyboard strokes.
Here is a resume of its malicious capabilities:
- Modifying auto-execute functionality by setting/creating a value in the registry;
- Reading the active computer name;
- Reading the cryptographic machine GUID;
- Possibly capable of evading analysis by sleeping many times;
- Opening the MountPointManager (often used to detect additional infection locations);
- Contacting 2 domains and 2 hosts;
- Modifying of Proxy settings.
It should be noted that the Skype.exe file actually belongs to Microsoft. However, the file which was uploaded to Hybrid Analysis appears to have been modified by an unpaid evaluation copy of Resource Tuner 2. It is a tool for disassembling .exe and .dll files.
Malicious Ads Served Over Skype
Skype has been abused to serve malicious ads not once or twice. Last year, users reported that ads served through the application were serving malicious downloads that were leading to a ransomware infection. The ads triggered a download of an HTML application which was designed to look like a legitimate app. Upon opening the ad would download a malicious payload, a piece of ransomware, which would then encrypt the user’s files.
Severe Security Flaws in Skype
There have been a number of serious security vulnerabilities in Skype which increase the vulnerability of the operating system and may lead to malware and spyware infections, or in other words – to variations of the Skype virus. Such a severe security flaw was discovered in February 2018. The severe could could allow attackers to obtain full access to the compromised host. This would happen through gaining system-level privileges to a local user with no privileges. The flaw was discovered by security researcher Stefan Kanthak who reported it to Microsoft. The flaw resides in Skype’s update installer found to be vulnerable to DLL hijacking.
The severity of the DLL hijacking vulnerability, however, is not the only issue here. Apparently, Microsoft, the owner of Skype, isn’t planning on fixing the flaw any time soon. The reason is not because the flaw can’t be patched. It’s because patching it would require the software to be entirely re-written. What does this mean? Instead of simply releasing a patch, Microsoft would have to release a brand new version of the messenger.
The attack leveraging the Skype DLL hijacking flaw can happen using a range of DLL files with various loading processes. The worst part is that no trails are left in both the registry and file system indicating that an incorrect DLL had been previously loaded.
In case of a successful hijacking of the update process, the attacker would download and place the maliciously crafted DLL into a temporary folder. When Skype’s update installer attempts to locate the relevant DLL, it will locate the malicious one instead, and will install the maliciously crafted code.
Even though Kanthak, the researcher who reported the flaw, tested the attack on the Windows desktop version of Skype, he believes that the same DLL hijacking technique could be used against other operating systems like Linux and macOS. It should be noted that the exploit of the flaw works on the desktop version of Skype.
Skype Virus: How to Remove It from the System
If you believe that your system was affected by a Skype virus, you can refer to the instructions provided below.
In case of the Goo.gl Skype virus, you should consider disconnecting your computer from the internet while scanning, since this will break any active connection with attackers’ C&C servers.
Note! Your computer system may be affected by Skype Virus and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as Skype Virus.
To remove Skype Virus follow these steps:
Use SpyHunter to scan for malware and unwanted programs
- Guide 1: How to Remove Skype Virus from Windows.
- Guide 2: Get rid of Skype Virus on Mac OS X.
- Guide 3: Remove Skype Virus in Google Chrome.
- Guide 4: Erase Skype Virus from Mozilla Firefox.
- Guide 5: Uninstall Skype Virus from Microsoft Edge.
- Guide 6: Remove Skype Virus from Safari.
- Guide 7: Eliminate Skype Virus from Internet Explorer.
- Guide 8: Disable Skype Virus Push Notifications in Your Browsers.
About the Skype Virus Research
The content we publish on SensorsTechForum.com, this Skype Virus how-to removal guide included, is the outcome of extensive research, hard work and our team’s devotion to help you remove the specific, adware-related problem, and restore your browser and computer system.
How did we conduct the research on Skype Virus?
Please note that our research is based on independent investigation. We are in contact with independent security researchers, thanks to which we receive daily updates on the latest malware, adware, and browser hijacker definitions.
Furthermore, the research behind the Skype Virus threat is backed with VirusTotal https://www.virustotal.com/gui/home/upload.
To better understand this online threat, please refer to the following articles which provide knowledgeable details.
1.Browser Redirect – What Is It?
2.Adware Is Malicious, and It Uses Advanced Techniques to Infect
3.The Thin Red Line Between Potentially Unwanted Programs and Malware
4.The Pay-Per-Install Affiliate Business – Making Millions out of Adware
5.Malicious Firefox Extensions Installed by 455,000 Users Blocked Updates
How to Remove Skype Virus from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove Skype Virus
Step 2: Uninstall Skype Virus and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it.
Step 3: Clean any registries, created by Skype Virus on your computer.
The usually targeted registries of Windows machines are the following:
You can access them by opening the Windows registry editor and deleting any values, created by Skype Virus there. This can happen by following the steps underneath:
1. Open the Run Window again, type "regedit" and click OK.
2. When you open it, you can freely navigate to the Run and RunOnce keys, whose locations are shown above.
3. You can remove the value of the virus by right-clicking on it and removing it.
Step 4: Scan for Skype Virus with SpyHunter Anti-Malware Tool
1. Click on the "Download" button to proceed to SpyHunter's download page.
2. After you have installed SpyHunter, wait for it to update automatically.
3. After the update process has finished, click on the 'Malware/PC Scan' tab. A new window will appear. Click on 'Start Scan'.
4. After SpyHunter has finished scanning your PC for any files of the associated threat and found them, you can try to get them removed automatically and permanently by clicking on the 'Next' button.
Video Removal Guide for Skype Virus (Windows).
Get rid of Skype Virus from Mac OS X.
Step 1: Uninstall Skype Virus and remove related files and objects
1.Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
2. Find Activity Monitor and double-click it:
3.In the Activity Monitor look for any suspicious processes, belonging or related to Skype Virus:
4.Click on the "Go" button again, but this time select Applications. Another way is with the ⇧+⌘+A buttons.
5.In the Applications menu, look for any suspicious app or an app with a name, similar or identical to Skype Virus. If you find it, right-click on the app and select “Move to Trash”.
6: Select Accounts, after which click on the Login Items preference.
Your Mac will then show you a list of items that start automatically when you log in. Look for any suspicious apps identical or similar to Skype Virus. Check the app you want to stop from running automatically and then select on the Minus (“-“) icon to hide it.
7: Remove any left-over files that might be related to this threat manually by following the sub-steps below:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove Skype Virus via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
1: Click on "Go" and Then "Go to Folder" as shown underneath:
2: Type in "/Library/LauchAgents/" and click Ok:
3: Delete all of the virus files that have similar or the same name as Skype Virus. If you believe there is no such file, do not delete anything.
You can repeat the same procedure with the following other Library directories:
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove Skype Virus files from your Mac
When you are facing problems on your Mac as a result of unwanted scripts and programs such as Skype Virus, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Video Removal Guide for Skype Virus (Mac)
Remove Skype Virus from Google Chrome.
Step 1: Start Google Chrome and open the drop menu
Step 2:Move the cursor over "Tools" and then from the extended menu choose "Extensions"
Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.
Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.
Erase Skype Virus from Mozilla Firefox.
Step 1: Start Mozilla Firefox. Open the menu window
Step 2: Select the "Add-ons" icon from the menu.
Step 3: Select the unwanted extension and click "Remove"
Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.
Uninstall Skype Virus from Microsoft Edge.
Step 1: Start Edge browser.
Step 2: Open the drop menu by clicking on the icon at the top right corner.
Step 3: From the drop menu select "Extensions".
Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.
Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.
Remove Skype Virus from Safari.
Step 1: Start the Safari app.
Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.
Step 3: From the menu, click on "Preferences".
Step 4: After that, select the 'Extensions' Tab.
Step 5: Click once on the extension you want to remove.
Step 6: Click 'Uninstall'.
A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the Skype Virus will be removed.
Eliminate Skype Virus from Internet Explorer.
Step 1: Start Internet Explorer.
Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'
Step 3: In the 'Manage Add-ons' window.
Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.
Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.
Remove Push Notifications caused by Skype Virus from Your Browsers.
Turn Off Push Notifications from Google Chrome
To disable any Push Notices from Google Chrome browser, please follow the steps below:
Step 1: Go to Settings in Chrome.
Step 2: In Settings, select “Advanced Settings”:
Step 3: Click “Content Settings”:
Step 4: Open “Notifications”:
Step 5: Click the three dots and choose Block, Edit or Remove options:
Remove Push Notifications on Firefox
Step 1: Go to Firefox Options.
Step 2: Go to “Settings”, type “notifications” in the search bar and click "Settings":
Step 3: Click “Remove” on any site you wish notifications gone and click “Save Changes”
Stop Push Notifications on Opera
Step 1: In Opera, press ALT+P to go to Settings.
Step 2: In Setting search, type “Content” to go to Content Settings.
Step 3: Open Notifications:
Step 4: Do the same as you did with Google Chrome (explained below):
Eliminate Push Notifications on Safari
Step 1: Open Safari Preferences.
Step 2: Choose the domain from where you like push pop-ups gone and change to "Deny" from "Allow".
Skype Virus FAQ
What is Skype Virus?
The Skype Virus threat is adware or browser redirect virus. It may slow your computer down siginficantly and display advertisements. The main idea is for your information to likely get stolen or more ads to appear on your device.
The creators of such unwanted apps work with pay-per-click schemes to get your computer to visit risky or different types of websites that may generate them funds. This is why they do not even care what types of websites show up on the ads. This makes their unwanted software indirectly risky for your OS.
What are the symptoms of Skype Virus?
There are several symptoms to look for when this particular threat and also unwanted apps in general are active:
Symptom #1: Your computer may become slow and has poor performance in general.
Symtpom #2: You have toolbars, add-ons or extensions on your web browsers that you don't remember adding.
Symptom #3: You see all types of ads, like ad-supported search results, pop-ups and redirects to randomly appear.
Symptom #4: You see installed apps on your Mac running automatically and you do not remember installing them.
Symptom #5: You see suspicious processes running in your Task Manager.
If you see one or more of those symptoms, then security experts reccomend that you check your computer for viruses.
What types of Unwanted Programs are there?
According to most malware researchers and cyber-security experts, the threats that can currently affect your Mac can be the following types:
- Rogue Antivirus programs.
- Browser hijackers.
- Fake optimizers.
What to do if I have a "virus" like Skype Virus?
Do not panic! You can easily get rid of most adware or unwanted program threats by firstly isolating them and then removing them from your browser and computer. One reccomended way to do that is by using a reputable malware removal software that can take care of the removal automatically for you. There are many anti-malware apps out there that you can choose from. SpyHunter is one of the reccomended anti-malware apps, that can scan your computer for free and detect any viruses, tracking cookies and unwanted adware apps and eliminate them quickly. This saves time when compared to doing the removal manually.
How to secure my passwords and other data from Skype Virus?
With few simple actions. First and foremost, it is imperative that you follow these steps:
Step 1: Find a safe computer and connect it to another network, not the one that your Mac was infected in.
Step 2: Change all of your passwords, starting from your e-mail passwords.
Step 3: Enable two-factor authentication for protection of your important accounts.
Step 4: Call your bank to change your credit card details (secret code, etc.) if you have saved your credit card for online shopping or have done online activiites with your card.
Step 5: Make sure to call your ISP (Internet provider or carrier) and ask them to change your IP address.
Step 6: Change your Wi-Fi password.
Step 7: (Optional): Make sure to scan all of the devices connected to your network for viruses and repeat these steps for them if they are affected.
Step 8: Install anti-malware software with real-time protection on every device you have.
Step 9: Try not to download software from sites you know nothing about and stay away from low-reputation websites in general.
If you follow these reccomendations, your network and all devices will become significantly more secure against any threats or information invasive software and be virus free and protected in the future too.
More tips you can find on our website, where you can also ask any questions and comment underneath the articles about your computer problems. We will try to respond as fast as possible.