A new worm is circulating via AIM, posing as the Windows Genuine Advantage (WGA) anti-piracy program. Is it virus-writing as an anti-Microsoft statement?
The Cuebot-K worm spreads via AOL Instant Messenger, disguising itself as the Windows Genuine Advantage program. Cuebot-K attempts to register as a new system driver service called 'wgavn', with the display name 'Windows Genuine Advantage Validation Notification'.
Once installed, it runs each time the computer is started. Cuebot-K disables the Windows firewall and opens a backdoor that gives hackers the ability to take control of the computer.
More information is available from anti-virus firm
Sophos.
