Worm Masquerades as Microsoft Antipiracy Program
Source: http://www.pcworld.com/resource/article/0,aid,126307,pg,1,RSS,RSS,00.asp
W32.Cuebot-K spreads via through AIM and disguises itself as Windows
Genuine Advantage on infected PCs.
Security analysts have detected a new piece of malware that appears to run
as a Microsoft program used to detect unlicensed versions of its operating
system.
The malware has been classified as a worm and spreads through AOL's
Instant Messenger program, said Graham Cluley, senior technology
consultant for Sophos PLC, a security vendor.
Sophos is calling it W32.Cuebot-K, a new variation in the Cuebot family of
malware. The worm has a range of malicious functions. After it's
installed, the worm immediately tries to connect to two Web sites, a sign
it may try to download other bad programs on the machine.
A Nasty Payload
Cuebot-K can disable other software, shut off the Windows firewall,
download new malicious programs, perform basic DDOS (distributed denial of
service) attacks, scan local files and spawn a command prompt, Sophos
said.
Worms that spread through instant messaging programs often appear as
messages or links sent from friends, which trick a user into executing the
program. Cuebot-K propagates by sending itself as a file named "wgavn.exe"
to more people in the user's "Buddy List" but without a message, Cluley
said.
Worm With an Ironic Twist
If installed on a computer, Cuebot-K is registered as a new system device
driver service named "wgavn." When a list of services running on the
computer is summoned, the worm appears as "Windows Genuine Advantage
Validation Notification" Sophos said.
Cuebot-K's registry entry appears as
HKLM\SYSTEM\CurrentControlSet\Services\wgavn\.
The worm's ironic ruse comes as Microsoft's Windows Genuine Advantage
program is being criticized for functioning like spyware. WGA collects
hardware and software data on a user's computer and compares it to a
database of licensed operating systems.
If an improper copy is detected, Microsoft warns the user and cuts off
some free downloads.
Spyware Doctor is a multi-award winning spyware removal utility that detects, removes and protects your PC from thousands of potential spyware, adware, Trojans, keyloggers, spybots and tracking threats.
Spyware Doctor is fully capable of detecting and removing hidden processes associated with complex threats and rootkits. Such threats are otherwise difficult to remove by conventional means since they may be hidden to the operating system.
A Startup Scanner removes references to malicious programs that run at startup in the registry and Windows startup files, as well as malicious files in Windows startup locations.
State-of-the-art scanning engines, including file scan, memory scan, registry scan, browser helper objects scan, cookie scan and much more.
