New Skype Worm Threatens All Skype Windows Users

The Internet Patrol default featured image
Share the knowledge

A new Skype worm, known alternately as Ramex, Pykspa, or Skipi (technical names w32/Ramex.A, W32.Pykspa.D, and W32/Skipi.A, respectively), is threatening all Skype users who are running Windows. The worm replicates itself by sending a Skype instant message from the infected user’s machine to everybody in the user’s Skype address book.

[Website maintenance provided by Usestrict and we love them!]

[On a side rant here, the reason for the three different names for the same worm is because the three leading anti-virus vendors, Symantec, F-Secure, and Kaspersky, insist on giving their own names to malware. When will this lunacy stop? It’s bad and confusing enough trying to deal with all the legion of trojans, viruses and worms, without having to also deal with three different names for each one!]

The instant message, which may appear to be from the infected user (and so trusted by the recipient) offers up what appears to be an innocent image file, but when clicked on of course it actually downloads the worm to the recipient’s PC.

Along with the file comes a message, such as “really funny”, “what ur friend name wich is in photo?” (sic), or “look what crazy photo someone sent me”.

According to the Skype blog, “When a Skype user receives the chat message – either from their Skype contacts or users not on their contact list – it includes an internet link. Instead of a .jpg image that it seems to point to, the link actually leads to a virus file. By clicking on the link, the Windows Run/Save dialog box will pop up, asking for permission to save or run a .scr file. This is the virus file and should not be downloaded or run. If the user accepts the file, however, their Windows PC will be infected with the w32/Ramex.A virus. The worm uses Skype’s public Application Program Interface (API) to access the PC.”

The Internet Patrol is completely free, and we don't subject you to ads or annoying video pop-ups. But it does cost us out of our pocket to keep the site going (going on 20 years now!) So your tips via CashApp, Venmo, or Paypal are VERY appreciated! Receipts will come from ISIPP.

CashApp us Square Cash app link

Venmo us Venmo link

Paypal us Paypal link

All three of the above anti-virus software vendors have updates which will detect the Ramex / Pyksp / Skipi worm, so if you are running a Windows PC and Skype, make sure that your anti-virus software is up-to-date.

The Internet Patrol is completely free, and we don't subject you to ads or annoying video pop-ups. But it does cost us out of our pocket to keep the site going (going on 20 years now!) So your tips via CashApp, Venmo, or Paypal are appreciated!
Receipts will come from ISIPP.

CashApp us Square Cash app link

Venmo us Venmo link

Paypal us Paypal link

Get New Internet Patrol Articles by Email!


Share the knowledge

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.