Skype installation virus?

Viruses and worms
1

I downloaded skype from the official website and at the end of the installation process Avast popped-up a virus warning (virus type: Win32:Evo-gen[susp]) at SkypebrowserHost.exe
I guess this is a false positve but can someone confirm this?

Thank you

2

If it’s from the Homepage then it’s safe.

Evo-Gen [Susp] means it was found to be susipcious when you tried to install skype. Just add an exclusion, report as FP and move on :slight_smile:

3

This is a so-called PUP warning. PUP is not a virus, it is a potentially unwanted program.
So when you know what it is doing, you have installed it intentionally by yourself and know where it stems from,
that install or that executable should not be a problem.
See: https://herdprotect.com/skypebrowserhost.exe-def28ddd837e6d09ebf6b704f45d85b971932cfc.aspx
It says: “the file is infected by a polymorphic file infector virus”, here: https://herdprotect.com/skypebrowserhost.exe-def28ddd837e6d09ebf6b704f45d85b971932cfc.aspx
Avast may detect: http://totalhash.com/search/av:Gardih*Win32*Gardih because of Microsoft Visual Basic v6.0 DLL in Chrome.exe for example.
It spreads through networks. As it is a PUP detection you should not worry that much, the risks are probably only privacy related.
See: http://systemexplorer.net/file-database/file/skypebrowserhost-exe/27547964
and
http://www.isthisfilesafe.com/sha1/B1780C15D555DA58554DB3F8988E4FED8902A06D_details.aspx

polonus

4

hmmm… Just updated Skype 6.21.73.104 last night ( through UI ) and no alert.

5

Polonus what are you going on about man?

With Pol’s info. Do me a favour. Locate this SkypeBroswerhost.exe file (avast! should give you a location). Scan it @ www.virsutotal.com

6

Michael, thank you (nice site). I did a scan as you said (after correcting the url to www.virustotal.com - you had a typo above). Here is the report:

-------Scan report for SkypeBrowserHost.exe ----------
This file was last analysed by VirusTotal on 2015-01-07 15:02:32 UTC, it was first analysed by VirusTotal on 2014-09-03 12:44:09 UTC.

Detection ratio: 0/55
-----------end report--------

I often look at the Skype folder contents inside Program Files(x86) and have never seen this folder called Browser until today. Inside it was our file: SkypeBrowserHost.exe

I ran SkypeBrowserHost.exe by double clicking wondering if it is related to Skype’s new Browser based feature we have heard was coming a few months ago. Nothing happened. No Avast warning. and nothing visible. I could see it running in task Manager. I did a search and found this thread. An Avast scan says No threat Found.

Thanks for the resources Polonus. I read about SkypeBrowserHost.exe on Herd Protect (See: https://herdprotect.com/skypebrowserhost.exe-def28ddd837e6d09ebf6b704f45d85b971932cfc.aspx ) and see I have an uninfected version:
There are 3 known versions of skypebrowserhost.exe by Skype Technologies.
44 / 68 (Infected)skypebrowserhost.exe 6.13.0.164 (32ec60f981153f695b412de8bf4a0dc28db4928a)
0 / 68 skypebrowserhost.exe 6.13.0.158 (7ba4acceee6dea1195b6543cad45c8090c0d2fcd)
0 / 68 skypebrowserhost.exe 6.13.0.158 (0ebc0cc5ba6cc5673c908fe2e24737205213061c)

So mine seems safe. One question: Does any one know what is used for?
Note: I am seeing his after setting up my laptop Win7, to stop Skype updates. I am wondering how these two things effect each other, if at all.

Lastly, I would love o connect with people more knowledgeable than I on Skype to discuss security issues. I have several Skype rooms on he subject of Skype and computer security. Skype ID juliewolf Skype Coach. When adding me, please refer o his thread with a url and he word SkypeBrowserHost.exe to remind me. Thanks.