AIM virus masquerades as Windows Genuine Advantage program

[Jeff]

A new worm is circulating via AIM, posing as the Windows Genuine Advantage (WGA) anti-piracy program. Is it virus-writing as an anti-Microsoft statement?

The Cuebot-K worm spreads via AOL Instant Messenger, disguising itself as the Windows Genuine Advantage program. Cuebot-K attempts to register as a new system driver service called 'wgavn', with the display name 'Windows Genuine Advantage Validation Notification'.

Once installed, it runs each time the computer is started. Cuebot-K disables the Windows firewall and opens a backdoor that gives hackers the ability to take control of the computer.

More information is available from anti-virus firm Sophos.