Skype 2.0 looked like a virus

[Update:  Skype fixed their software four days after I wrote this original story.]

I've been a huge fan of Skype in recent years because of their user friendliness and seamless encryption, but I was shocked to find that Skype 2.0 triggered a DEP (Data Execution Prevention) warning on my new computer running Windows XP SP2.  DEP is a new security mechanism in Windows XP SP2 that makes use of the new NX and XD (No Execute and Execute Disable) technology built in to modern AMD and Intel microprocessors to prevent common security exploits from launching.  While most people are not aware of the new NX/XD protection mechanism that Windows and other modern operating systems affords, it could easily save them from the next zero-day cyber attack before any other protection method is available.

In the most recent example, DEP when configured correctly easily stopped the WMF Exploit in its tracks even when no other protections were in place.  Since then, I've made it a point to change the default Windows XP SP2 settings and turn on hardware-enforced DEP on all programs and services.  The ability to preemptively mitigate known and future unknown malicious code execution is extremely valuable because we can't always hope that the antivirus definitions will be up-to-date or that people will update to the latest virus definition files.  We can't even be certain that people will bother to install antivirus or patch their computers for the latest security vulnerabilities.  This is why it's so important for people to only buy new computers with AMD NX or Intel XD enabled CPUs and turn on DEP protection for all programs and services.

Microsoft left the default settings for DEP in a half functioning state which only protected essential programs and services fearing it would generate a lot of complaints from incompatible legacy applications and result in a lower adoption rate for Windows XP SP2.  In my experience, I haven't had too many issues with DEP incompatibilities which is why I was shocked that the latest version of Skype triggered the following DEP warning:

To fix the problem, I had to click on the "Change Settings" button in the warning dialog and then modify the DEP exception list.  "Skype. The whole world can talk for free." was already conveniently inserted in to the exception list for you with an empty checkmark box next to it.  All I had to do is check the box and hit OK and Skype no longer triggered the DEP warning as shown here:

While this may seem simple enough, it isn't always so obvious to the novice user who may not even be an administrator with the necessary privileges to modify the DEP settings.  This is certainly out of character for an application that prides itself in ease-of-use.  For all the user knows, Skype just looks like any other malicious code trying to infect their computer.

With the DEP exception in place, an even bigger concern is the security implications of turning off DEP protection for Skype.  Skype is an application that interacts with the wild and public Internet and Skype has had its share of vulnerability issues in the past so turning off a critical protection mechanism like DEP is the last thing I want to do.  Having DEP enabled on Skype will at least give users some protection if Skype has any future vulnerabilities.  Skype really needs to get their act together and fix this problem as soon as possible.