Worm Appears as Microsoft Antipiracy Program

Security analysts have detected a new piece of malware that appears to run as a Microsoft program used to detect unlicensed versions of its operating system.

The malware has been classified as a worm and spreads through AOL’s Instant Messenger program, said Graham Cluley, senior technology consultant for Sophos, a security vendor.

Sophos is calling it W32.Cuebot-K, a new variation in the Cuebot family of malware. The worm has a range of malicious functions. After it’s installed, the worm immediately tries to connect to two websites, a sign it may try to download other bad programs on the machine.

Cuebot-K can disable other software, shut off the Windows firewall, download new malicious programs, perform basic distributed denial-of-service attacks, scan local files and spawn a command prompt, Sophos said.

Worms that spread through instant-messaging programs often appear as messages or links sent from friends, which trick a user into executing the program. Cuebot-K propagates by sending itself as a file named “wgavn.exe” to more people in the user’s “Buddy List” but without a message, Cluley said.

If installed on a computer, Cuebot-K is registered as a new system device driver service named “wgavn.” When a list of services running on the computer is summoned, the worm appears as “Windows Genuine Advantage Validation Notification,” Sophos said.

Cuebot-K’s registry entry appears as HKLMSYSTEMCurrentControlSetServiceswgavn.

The worm’s ironic ruse comes as Microsoft’s Windows Genuine Advantage (WGA) program is being criticized for functioning like spyware. WGA collects hardware and software data on a user’s computer and compares it to a database of licensed operating systems.

If an improper copy is detected, Microsoft warns the user and cuts off some free downloads.

-Jeremy Kirk, IDG News Service (London Bureau)

Related Links:

• Microsoft Faces Class-Action Suit over Antipiracy Tool

• Pressure Spurs Microsoft to Revise Antipiracy Program

• Tool Deletes Microsoft Piracy Alarm

• Microsoft: Windows Antipiracy Tool Not Spyware

This article is posted on our Microsoft Informer page. For more news on the Redmond, Wash.-based powerhouse, keep checking in.

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.