A new computer virus that invades the application Skype was recently discovered by Palo Alto Networks. The attacker, referred to as T9000, is a backdoor virus that is a variant of the T5000 malware that gets through 24 security products.

By definition, backdoors are viruses that enter the system without going through usual routes and remains undetected by security mechanisms.

The 24 antivirus products found to be evaded by T9000 are Sophos, INCAInternet, DoctorWeb, Baidu, Comodo, TrustPortAntivirus, GData, AVG, Bit Defender, VirusChaser, McAfee, Panda, Trend Micro, Kingsoft, Norton, Micropoint, Filseclab, AhnLab, JiangMin, Tencent, Avira, Kaspersky, Rising and 360.

According to Palo Alto researchers Josh Grunzweig and Jen Miller-Osborn, T9000 captures encrypted data and could even take screenshots of specific applications, and has aimed attacks on Skype users. Through Skype invasion, the virus enables the attacker to steal files and information about the victims including those stored on removable media.
Once a machine is infected the following data are gathered: installed security products, system time, build number, CPU architecture, MAC address, IP address, hostname, username, parent executable name and plugin configuration information.

Through the virus, the following commands may be executed: directory listing (DIR), drive listing (LIR), execute command (RUN), send command to interactively spawned command (CIT), kill interactively spawned process (CFI), download file (DOW), upload file (UPL), delete file (DEL), retrieve statistics for file (DTK) and null command (ERR).

Skype enables users all over the world to communicate through voice and video calls. The past years have seen the growth of users who rely on Skype for both personal and business purposes. The virus invades all forms of Skype communications and can even record video and audio calls, including chat messages. It allows screen capture of ongoing video calls and window images as well.

The user may not be aware that he or she is permitting access since the malware requests access through a legitimate process.