I just downloaded SkypeSetup.exe from skype.com and on a scan with ClamWin I receive the following message:

SkypeSetup.exe: Trojan.Downloader-52394 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 401508
Engine version: 0.93.1
Scanned directories: 0
Scanned files: 1
Infected files: 1

Data scanned: 95.92 MB
Time: 53.406 sec (0 m 53 s)

Does SkypeSetup really have a trojan embedded in it? Thanks for your help.

JM

P.S. sorry about the double post in two forums but I wasn't sure which forum this was most relevant too. Again my apologies.

Hello,

Welll, that's strange. I have Skype installed on both my machines (1 desktop with XP, 1 laptop with Vista Home) and none of my AV's (Avira antivir as resident, ClamWin as backup scanner) has ever detected anytyhing.
Be sure that software has been downloaded from official site. If it is so this should be a false positive definitely.
However, to be sure upload the file to Virustotal (https://www.virustotal.com/) or run a scan of yr. hard drive with an on line scanner (you will find further references on Clamwin's Anti Malware Resources page, just choose what suits you better).

It it's a false positive pls notify Clam team using the form @ https://cgi.clamav.net/sendvirus.cgi

Regards,
Antonio

Thanks Antonio for your response.

I refreshed the ClamWin database again today Aug 27 2008 and now ClamWin is no longer reporting the same SkypeSetup.exe binary as having the Trojan - hope that's a legit upgrade as I am about to install Skype with this SkypSetup.exe As another data point, I did use the online DrWeb antivirus scan and it too reported the SkypeSetup.exe as clean (https://www.drweb-online.com/en/virustest.html). Separate but related note, virustotal.com is another online virus scanner but it does not scan files larger than 10MB while Dr Web did not impose this limit on the SkypeSetup.exe (20+MB).

Hope this helps other people in the same situation.

JM

Hello,

I also made a test with the most recent installer of skype (version 3.8.0.154) and scanned it both with my resident AV (Avira Antivir Free) as well as with Clamwin. In both cases file came out clean. Moreover what you have reported below gives me some extra confidence about reaction time of Clam team in updating or modifying their signature DB (considering it is partly maintained by voluntary work of a community).

Limitations of file size for Virustotal uploading: thanks for pointing this out , I had forgotten about that.

Regards,
Antonio