www.fusspils.net

Well thanks Skype for the evening of overtime I will now have to do removing this from client machines and putting in policies to block your use in the future!

The Skype forums are a hive of panic and abuzz with accusations that either the company is bundling crapware with its VoIP app or has a serious security problem. Users are reporting that a strange, new, and difficult to uninstall program is finding its way on to their PCs called EasyBits GO. EasyBits is the company that has powered Skype's games channel since 2006, but at least until now its wares have not been standalone software. One moderator has declared EasyBits Go is not part of Skype and suggested customers immediately run a malware scan, but mods are volunteers and not official representatives of the company, so we're taking it with a grain of salt. Another (later) post from a forum admin simply states that Skype is looking into the issue and will release an official statement, though we have no idea when that might actually happen and we're awaiting reply to our own request for comment.

It appears that a rep from EasyBits Media has taken to the forums to quell some of the outrage, but to no avail. Posts from the team are painfully vague, saying that it was part of an update to the gaming platform and apologizing for the misunderstanding, before linking directly to an .exe that it claims will remove the offending software. To say that forum users are wary of the executable would be an understatement (most responses have involved torrents of profanity). Reports are that the suspicious app is installing itself without any approval from users, but we can't confirm this since any attempts to install in our lab of doom resulted only in errors while downloading. For now, we'll just have to wait for word from Skype, and the company better move quick -- the pain of the recent outage is still fresh in many customers' minds.

Update: Skype has officially confirmed that EasyBits GO was erroneously added to its installer, and says that the buggy update has been disabled for now. Strangely, the official blog suggests that disabling the software is a temporary measure, and that it might reappear soon, as Skype will "work with them to correct the problems and user experience" that led to user qualms.

Source Engadget


Details on the Threat

http://www.threatexpert.com/report.aspx?md5=f6a970c3351815ac9d932a792f23be45


"Apology" From Skype

http://blogs.skype.com/garage/2011/05/easybits_update_disabled_for_s.html

I've recently been given the task of setting up a new Sharepoint 2010 installation for the Finance department at work with the view of using the Business Intelligence Center and also Excel Services.  The idea is to have Excel documents embedded in a website which would then connect to OLAP cubes which in turn connect to a SQL server to pull the data.

Anyway I digress, I hit a very strange problem with a service called "Claims to Windows Token Service"
Everything was setup and working, Excel docs pulling data etc and then seemingly on random occasions everything would just fail with a permissions error and this Claims token service was disabled.  It didnt just shut down it disabled itself.  After a lot of troubleshooting and trying many different things I noticed that the service would shut down exactly on the hour every hour.  This then lead me to the sharepoint services that run on an hourly basis, about 15 of them.  You can review them in Sharepoint central administration -> Monitoring -> Review Job Definitions then sort by Schedule Type.

I went through each one of these hourly run services and did a manual run checking if the C2WTS had been disabled or not.  Half way through the list I can to the problem service "Health Analysis Job (Hourly, Microsoft SharePoint Foundation Timer, All Servers)"
Diabled this and no more problems, the C2WTS stays up.  Now to find out why this service kills CTWTS!!

Addendum

Another problem that I had with this service was after a reboot it would be disabled, it really wants to kill itself this service!  This can be fixed by..

Open CMD.exe as admin and type
C:\> sc config c2wts depend= cryptsvc

Then if you right click the service, properties and click on the dependencies tab you should see the Cryptographic Services listed