Perfidious virus pushers have created a worm that poses as Microsoft's anti-piracy program, Windows Genuine Advantage (WGA).

The Cuebot-K worm spreads via AOL instant messenger in the guise of WGA. The timing of the release of the malware coincides with controversy over a feature in WGA that meant that the anti-piracy program "phoned home" with hardware and software data from PCs every time Windows started up.

Cuebot-K attempts to register itself as a new system driver service called 'wgavn', with the display name 'Windows Genuine Advantage Validation Notification'. Thereafter it runs every time a computer starts up. Users who attempt to remove the malware are falsely informed that getting rid of the program will result in system instability.

Once installed on infected machines, Cuebot-K disables Windows firewall and opens a backdoor on compromised machines, surrendering their control to hackers.

More information on the malware can be found in an analysis by anti-virus firm Sophos here. ®

Related stories

Counterfeit Vista rate half that of XP (4 December 2007)
MS drops nagware validation for IE7 installs (5 October 2007)
Microsoft admits WGA update phones home (9 March 2007)
Microsoft's WGA changes today (20 February 2007)
One in five fail Windows validation checks (24 January 2007)
MS builds tougher piracy protection into Vista (5 October 2006)
Microsoft keelhauls 26 pirates (18 July 2006)
Windows genuine disadvantage (7 July 2006)
Get your Mac, it's raining Trojans (5 July 2006)
MS fixes phone-home nagware (28 June 2006)
How to stop Microsoft's WGA phoning home (22 June 2006)
Microsoft WGA row continues (12 June 2006)
Santa worm is coming to IM (22 December 2005)
Windows Genuine Advantage cracked (29 July 2005)
Fake news spreads email virus (29 June 2005)
Trojan leaps from bogus Windows Update site (8 April 2005)
Trojans exploit Windows DRM loophole (13 January 2005)