IRCbot Trojan Spoofing Skype
Security firm MessageLabs has detected a new variant of the IRCbot Trojan disguised as the latest release of the popular Skype VoIP software client version 1.4.
More than 150 copies of the IRCbot, also known as Fanbot that is distributed via e-mail, have already been blocked by MessageLabs researchers.
MessageLabs has put a "medium risk" rating on the threat.
The malicious code disguised as VoIP software client, version 1.4, which was first released last month . If executed, it attaches a malware program that displays a fake "installation error" box.
However, it is actually installing itself as sysdir%remote.exe, altering the registry and shutting down shared access and Windows update services, according to MessageLabs researchers.
Maksym Schipka, a senior antivirus researcher at MessageLabs, said the latest phishing attack is the first case the company had seen that specifically mentions Skype.
