Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

CSA 4.0.3 Skype making IRC connections.

Does Skype make IRC connections?

We are detecting this all the time from multiple ports:

"Potential worm propagation: The process 'C:\Program Files\Skype\Phone\Skype.exe' (as user ) has read downloaded content (file C:\Program Files\Skype\Phone\Skype.exe) and attempted to access an email or network related resource (making a Network IRC connection, 6//6737).This is considered suspect. The user chose 'Terminate (as default)'."

Skype Tech support said that Skype UDP traffic is mistakenly considered by CSA as an IRC connection.

This is a known "bug" in Cisco Security Agent.

I have searched for that bug but could not find any thing related.

Any thoughts?

  • Other Security Subjects
2 REPLIES

Re: CSA 4.0.3 Skype making IRC connections.

Hi .. I would be very cautious about using Skype .. in one of our customers CSA reported Skype's processes capturing keystrokes .. so who really knows what goes on in the background ..

Blue

Re: CSA 4.0.3 Skype making IRC connections.

4.0.3 does have it's limitations. I would question their tech support a bit further. We get messages from web pages initiating IRC connections and it's usually because there is some sort of messaging window open on the page.

You could create a rule that monitors Skype and logs what connections it makes and what and where it accesses if you want more info.

You might also try a test install of 5.x and see if it sheds more light on the situation.

Tom S

365
Views
0
Helpful
2
Replies
This widget could not be displayed.