July 1, 200619 yr W32.Cuebot-K spreads via through AIM and disguises itself as Windows Genuine Advantage on infected PCs. Jeremy Kirk, IDG News Service Friday, June 30, 2006 Security analysts have detected a new piece of malware that appears to run as a Microsoft program used to detect unlicensed versions of its operating system. The malware has been classified as a worm and spreads through AOL's Instant Messenger program, said Graham Cluley, senior technology consultant for Sophos PLC, a security vendor. Sophos is calling it W32.Cuebot-K, a new variation in the Cuebot family of malware. The worm has a range of malicious functions. After it's installed, the worm immediately tries to connect to two Web sites, a sign it may try to download other bad programs on the machine. A Nasty Payload Cuebot-K can disable other software, shut off the Windows firewall, download new malicious programs, perform basic DDOS (distributed denial of service) attacks, scan local files and spawn a command prompt, Sophos said. Worms that spread through instant messaging programs often appear as messages or links sent from friends, which trick a user into executing the program. Cuebot-K propagates by sending itself as a file named "wgavn.exe" to more people in the user's "Buddy List" but without a message, Cluley said. Worm With an Ironic Twist If installed on a computer, Cuebot-K is registered as a new system device driver service named "wgavn." When a list of services running on the computer is summoned, the worm appears as "Windows Genuine Advantage Validation Notification" Sophos said. Cuebot-K's registry entry appears as HKLM\SYSTEM\CurrentControlSet\Services\wgavn\. The worm's ironic ruse comes as Microsoft's Windows Genuine Advantage program is being criticized for functioning like spyware. WGA collects hardware and software data on a user's computer and compares it to a database of licensed operating systems. If an improper copy is detected, Microsoft warns the user and cuts off some free downloads.
Create an account or sign in to comment