A Skype worm is loose, computer security software ZoneAlarm could be used to hijack or crash a machine and Window's Server users should implement a vulnerability workaround, researchers say.

An instant-messaging worm that spreads through Skype and Skype-enabled programs is spreading links to malware through people's Skype contacts list on infected machines, Finnish computer security firm F-Secure Corp. said Monday.

Before sending the link, the worm also sets the infected Skype user's online status to "do not disturb," stopping notifications of incoming calls or messages, an F-Secure researcher wrote in a post to the company's security labs weblog.

Upon clicking the link in the message, malware is downloaded to the victim's machine, and once executed, displays a picture of a scantily clad woman, F-Secure said.

The worm appears to promote a series of identical websites focused on African tourism, which are likely being used as a counter to track infections, F-Secure said.

Another vulnerability, reported Sunday on Symantec Corp.'s Security Focus site, involves the popular PC firewall software ZoneAlarm.

The software, which comes in free and paid-use versions, has a weakness that could allow an attacker to send unverified instructions or data to a component of the program, resulting in a crash or potentially giving full access to the system. The vulnerability's effect is to deny people access to their computers.

The problem affects ZoneAlarm Pro versions 6.1.744.001, 6.5.737.000 and possibly others.

Check Point Software Technologies Ltd. had in January issued an update to the software — version 7.0.302 and higher —  that already addresses the newly discovered bug.

The flaw was originally reported on Sunday by David Matousek of Matousec security.

Microsoft touts Windows Server hole workaround

Also on Sunday, Microsoft updated customers about a "highly critical" vulnerability in the Domain Name System (DNS) Server service for its Windows Server versions 2000 and 2003 and urged them to implement a workaround issued on Thursday.

The world's largest software maker found another way to gain access to the vulnerability and discovered that the workaround may have unexpected effects on some systems.

Administration and configuration of the DNS Server "may not work if the server has a computer name of 15 characters or longer," Microsoft said in its updated advisory and recommended that technicians use the system's full name to manage it.

"Our teams are continuing their work to develop a security update to address this issue. Our ongoing monitoring … indicates that attacks are still limited," researcher Christopher Budd wrote in a post to the Microsoft Security Response Center blog.

"We continue to urge customers to deploy the workarounds in their environments as quickly as possible."