Hack75.Scan Files Received via Skype for Viruses

Hack 75. Scan Files Received via Skype for Viruses

Check files you receive via Skype file transfer immediately for viruses.

Works with: Windows, Linux, and Mac OS X versions of Skype.

File transfer using Skype is both simple and secure. Secure in the sense that files are transferred using end-to-end encryption, not in the sense that they are free from viruses.

You should never accept file transfers from strangers. But even receiving files from friends and contacts is not without some risk. Whoever is sending you a file might be doing so from a machineunknown to themthat is infected with viruses. By sending you a file, they may unwittingly infect your machine too. Skype is well aware of this potential vector (means of infection) for viruses, and that is why the recipient of a file transfer always has the option of accepting or rejecting the file transfer. Moreover, Skype is quite explicit about the need to scan received files for viruses (see Figure 9-5).

Figure 9-5. Skype warns of the potential for infecting your machine with a virus by accepting a file transfer (Linux)

Fortunately, scanning files for viruses and, in some cases, fixing them is easy with most of today's antivirus software. Most antivirus software has a nice GUI that allows you to scan your whole machine, or a specific file or folder. So, immediately after receiving any file, you shouldbefore opening itscan it for viruses. By default, Skype deposits transferred file into these folders:

Windows

C:\Documents and Settings\ UserName\My Documents\My Skype Received Files

Linux

/home/ UserName

Mac OS X

/home/ UserName/Library/Application Support/Skype/SkypeName

UserName is the username you use to log on to your machine, and SkypeName is the name under which you signed into Skype.

If you are the type of person who shuns the GUI, you always have the option of scanning received files at the command line. Here are some examples of scanning from the command prompt:

Windows (AVG Free Edition, http://free.grisoft.com/)

 cd C:\Documents and Settings\Andrew Sheppard\My Documents\My Skype  Received Files AVG /clean /arc /report scan.log /scan *.* 

Linux (Clam AntiVirus, http://www.clamav.net/)

 cd /home/shep clamscan-recursiveremove --stdout . > scan.log 

Mac OS X (Clam AntiVirus, http://www.clamav.net/)

 cd /home/shep/Library/Application Support/Skype/skypehacksmac clamscan-recursive-removestdout . > scan.log 

In these examples, I used the free antivirus software listed. However, if you use something different, check your product's documentation, as you will most likely find that you can run it from the command line.

9.3.1. Hacking the Hack

Scanning transferred files can soon become a chore you could do without. Fortunately, automating the process is easy, as these scripts demonstrate. Each time a new file appears in your default file-transfer folder, it will be scanned and, if possible, cleaned of any viruses. Or, if necessary, the file will be removed (deleted).

All the scripts presented in this hack will start scanning files in your default Skype file-transfer folder only after they start running. In the case of Windows and Linux, you can have the scripts do an initial scan on startup as well by changing the initial file count outside the do-while loop, like this: num_files = 0 (Windows), numfiles = 0 (Linux).

9.3.1.1. Windows (VBScript, AVG Free Edition).

 ' File: virus_scan.vbs ' To use this script yourself, you will need to ' change skype_file_transfer_folder and ' run_anti_virus to be compatible with folder ' locations and the anti-virus software you ' have installed on your computer. Files infected ' with a virus are cleaned automatically. Dim objShell, objFSO, objFolder, objFiles, objExec Dim skype_file_transfer_folder, num_files, run_anti_virus Set objShell = WScript.CreateObject("WScript.Shell") Set objFSO = WScript.CreateObject("Scripting.FileSystemObject") skype_file_transfer_folder = "C:\Documents and Settings\" & _ ............................ "Andrew Sheppard\My Documents\" & _ ............................ "My Skype Received Files" run_anti_virus = "C:\Program Files\Grisoft\AVG Free\AVG.exe " & _ ................ "/clean /arc /report scan.log /scan *.*" Set objFolder = objFSO.GetFolder(skype_file_transfer_folder) Set objFiles = objFolder.Files num_files = objFiles.Count Do ....If objFiles.count > num_files Then ........objShell.CurrentDirectory = skype_file_transfer_folder ........Set objExec = objShell.Exec(run_anti_virus) ........Do While objExec.Status = 0 ............WScript.Sleep 100 ........Loop ....End If ....num_files = objFiles.count ....WScript.Sleep 5000 ' Go to sleep for 5 seconds Loop While True 

9.3.1.2. Linux (Python, Clam AntiVirus).

 #!/usr/bin/env python # -*- coding: iso-8859-15 -*- # File: virus_scan.py # To use this script yourself, you will need to # change the paths to be compatible with folder # locations and the anti-virus software you # have installed on your computer. Files infected # with a virus are removed automatically. import os, time, sys def num_files():  ....file_count = 0  ....for root, dirs, files in os.walk('/home/shep/skype_file_transfer'): ........file_count += len(files) ....return file_count def main(): ....numfiles = num_files() ....while 1: ........if num_files() > numfiles: ............output = os.popen('clamscan --recursive ' \ ............+ '--remove --stdout ' \ ............+ '/home/shep/skype_file_transfer').read( ) ............file = open(r'/home/shep/' + \ ............'skype_file_transfer/scan.log', 'a') ............file.write('---- START SCAN ----\n\n') ............file.write(output) ............file.write('\n---- END SCAN ----\n\n') ............file.close( ) ............print output ........numfiles = num_files( ) ........time.sleep(5) ....return 0 if __name__ == "__main_ _": ....main( ) 

9.3.1.3. Mac OS X (AppleScript, Clam AntiVirus).

This AppleScript, virus_scan.scpt, can be attached to a folder-actionin this case, the "new item alert" actionthat will run the script every time a new file is added to your default folder for file transfers. This means that every time you accept a file transfer to this folder, the script will run and check it for viruses.

To set up a folder-action, in the Finder application locate the default Skype file-transfer folder, Ctrl-Click on it, choose Attach a Folder Action…, and then attach the virus_scan.scpt script. Now, every time you accept a file transfer, you know it will be scanned for viruses immediately. This script will run on action until you disable or delete the folder-action with which it is associated. Even after rebooting, it'll still be there doing its job!

To have virus_scan.scpt available as a folder-action script, you must put it in the folder-action scripts folder, /Library/Scripts/Folder Action Scripts/:

 -- File: virus_scan.scpt -- To use this script yourself, you will need to -- change the path to be compatible with folder -- locations and the anti-virus software you -- have installed on your computer. Files infected -- with a virus are removed automatically. do shell script "cd /home/shep/Library/Application Support/Skype/
 skypehacksmac ; clamscan-recursive-remove -stdout . >> scan.log"