top of page
Search
beckascxb

Skype says I’m infected with malware: How to remove it with Windows Security



When surfing the Internet, you sometimes encounter certain Web pages that do not open when you try to access them. This can be problematic for your business if you need access to the information on these pages. The cause of this can either be a fault with the website or the company hosting it, or an error on your computer. If other Web pages load correctly and you are sure that your Internet connection working properly, there are a few methods to check why certain pages won't open. Common causes are malware, browser security settings or firewalls.


Certain types of malware can prevent access to Web pages to prevent you from removing the infected files. Download and install a free malware scanner, such as Spybot Search & Destroy, Combofix or the Microsoft Malicious Software Removal Tool, and perform a full scan of your computer. The software should remove any malware that could be preventing certain Web pages from opening. Try to open the Web pages in different browsers to make sure that the fault is not with the browser settings. Clear the browser cache and cookies and attempt to reload the page.




Skype says I’m infected with malware…



@Juergen: A high-level application like Skype interfacing directly with the hardware sounds very much 1990 (remember the compatibility headaches?). Moreover, if the malware is a bootkit/rootkit, no software interface will protect you anyway.


As Macs make their camera sharable to multiple apps at the same time for perfectly legitimate reasons, it's possible to create a malicious app that asks to use the webcam. Unlike with current Mac malware strains - like Eleanor and Crisis - the app wouldn't just start using the camera, as the LED light would turn on and alert the user. Instead, Wardle's malware would wait until another app - like Skype or Google Hangouts - ran so the spyware could piggyback on the process and start recording the victim.


Windows Security (or Windows Defender Security Center in Windows 8 or early versions of Windows 10) is built in to Windows and provides real-time malware detection, prevention, and removal with cloud-delivered protection. It is intended for home, small business, and enterprise customers. For more info, see Help protect my computer with Windows Security.


(661) 748 0240 appears on outbound calls for Skype users - who have not set up their Skype caller ID yet. A Skype forum says this number is a generic default number. So, it could be from anyone and different people and "entities," and perhaps from a real friend or family member. It is also found to be a "spoofed" phone number, which means CYBERCRIMINALS "tricked" your caller ID to display the incorrect or default skype phone number with a nefarious purpose. NO LEGITIMATE BUSINESS WOULD USE a Skype default # unless they're hiding something.


Telemarketers do this so you cannot complain. Crooks do this to sell malware, scam you into giving them a remote connection of your computer to fix what is "infected with viruses", impersonate Microsoft, ISP or other company, to extort or commit other crimes. Criminals are noted to use personal information in the phone calls.


I have a skype account (you need one to use it), but I just put $10 in my account at a time - I don't use skype that often. Since I don't have a skype subscription for 6 months or a year or whatever, I was not given my own personal phone number. When you have your own number, people can call you using that number, and it should show up on their caller ID when you place a call. Because I don't have my own skype phone number, when I phone you your the caller ID will show a phone number that skype has available at the time for non-subscriber users.I'm sure some people use skype for their own particular evil purpose, and enjoy calling without leaving a phone number at which they could be traced. I am believe that most people who use skype as I do, just use it for regular calls because it is reliable and very inexpensive. For example, I can place a call to anyone in the USA from most any phone in Europe, for only 3 or 4 cents a minute, and the call is nearly as clear as if I were calling from next door. The number that shows up on their caller ID however, will be one of the skype US numbers available at the time of my call. If I had a regular subscription, it would show my personal phone number at which you could call back. So, if you get a call from this number, it could be from an undesirable caller, or it could be from your nephew Tim.


This number calls everyday at the same time, despite me telling him to stop. Some guy with a bad English accent, says he's calling from an investment company in London and has investors interested in our company...Uh huh.


I received the same type of call, but he claimed he was a Dell Tech and that they were showing that my computer was infected. He started to walk me through some steps that brought up a list of errors my computer was experiencing. When he said he needed to take control of my computer to fix it, I got suspicious and hung up. Called Dell...they said they do not monitor my computer. He called back again and argued with me that he really was from Dell. Hung up. Blocked the number. Call blocker list 11 more times he called in 4 days.


Flashing red pop up came up on my computer screen saying the system was infected with a virus and I needed to call 888-994-4480 immediately for help with the virus. When I called, man with Indian accent answered but he couldn't hear me. Someone called back from 678-666-4260; I became suspicious and asked to speak with a supervisor. The man hung up. A few minutes later someone by the name of David saying he was from Microsoft called from 661-748-0240; his number flashed "Spam Caller" on caller i.d. I confronted him about being a scammer and asked for the name of the business which he refused to give me. I asked where he was located and he refused to say so I hung up. These are criminals looking to actively defraud people by getting telephone access to their computers, infecting them with a virus then being paid to fix the problem they created. Give them no information about yourself.


By looking at your screenshots you seem to be running a modern version of macOS. Are you instead running Mountain Lion or older then you could have been automatically infected, as these versions did indeed have a problem with DMGs being able to auto-start programs.


The reason I write "ordinarily" and "normally" above is that there's a very slight risk that the file has exploited a problem with the metadata parsing that macOS does of the DMG. I.e. macOS uses information from within the DMG to display images, potentially display license information, etc. It is possible for malware to exploit a security hole within the image decoding library for example to infect your computer just by double-clicking the DMG. However, this seems to be quite unlikely given the information you have presented.


In addition to the basic functionality all backdoors provide, T9000 allows the attacker to capture encrypted data, take screenshots of specific applications and specifically target Skype users. The malware goes to great lengths to identify a total of 24 potential security products that may be running on a system and customizes its installation mechanism to specifically evade those that are installed. It uses a multi-stage installation process with specific checks at each point to identify if it is undergoing analysis by a security researcher.


At this point, the malware will read in the dtl.dat file, which contains configuration data. Data contained with this file starting at offset 0x20 is xor-encrypted using a single-byte key of 0x5F. The following script can be used to extract the IP address and port for the C2 server from this file.


The malware will then read in and parse the included plugin configuration information, which is found within the glp.uin file that was previously dropped. These included plugins are encrypted and compressed using the same method witnessed by the hjwe.dat file previously. The previously included script can be used to decrypt and decompress the following three plugin files:


The malware includes proxy support in the event that the victim is behind a web proxy. Network traffic occurs over a binary protocol on the port specified within the configuration. Traffic is xor-encrypted with a single-byte key of 0x55 in an attempt to bypass any network security products that may be in place. Once decrypted, the following traffic is sent by the malware.


The victim must explicitly allow the malware to access Skype for this particular functionality to work. However, since a legitimate process is requesting access, the user may find him- or herself allowing this access without realizing what is actually happening.


This type of malware is the digital equivalent of old-school telephone wiretapping, and whether it is simply a useful tool for police to catch criminals or a terrifying "Big Brother" enabler depends very much on the type of government that is giving the orders. While "wiretapping" evokes images of black-suited investigators attaching wires to physical phone lines, these days a telephone call can be intercepted digitally from the phone company without any manual labor. Tapping of Skype calls is, for now, a more difficult endeavor that requires the policeware to be installed on the target's computer. However, as open source advocate Richard Stallman pointed out in a post on Boing Boing, unless you are using open-source VoIP software you can't necessarily guarantee that a wiretapping backdoor hasn't been built into the software already. This doesn't appear to be the case with Skype at the moment, though.


Norton SafeCam enables you to be secure when you use webcam devices on the Internet. It prevents applications and malware from accessing your computer's webcam without your consent. These malicious applications can post confidential information against your interest or it can potentially be used to blackmail or extort money. Norton SafeCam offers protection against malware that tries to obtain access to your webcam. 2ff7e9595c


2 views0 comments

Recent Posts

See All

Comments


bottom of page