The new worm 'slips' Microsoft's WGA software

Security experts have discovered a new malware spoofing software that "sniffs" pirated Windows versions of Microsoft.

According to the classification of expert Graham Cluley, Sophos, this malware is a worm that spreads through AOL's IM chat program. Sophos named it W32.Cuebot-K, a new variant of the Cuebot malware family.

W32.Cuebot-K is a "versatile" worm. Once installed, it will immediately attempt to connect to the two default websites - a sign that its ultimate goal is to find ways to download other malware to the computer.

Source: 24x7updates And yet, Cuebot-K can also disable antivirus software, turn off the Windows firewall, perform basic denial-of-service attacks, scan files on your computer .

Often worms spread through chat programs often appear in the form of a message or link sent from a friend, forcing users to click and activate. For his part, Cuebot-K spread by sending it itself as a file called "wgavn.exe" but there was no accompanying message.

When the installation is completed, Cuebot-K will register as a new system device driver service wgavn, ie Windows Genuine Advantage Validation Notification.

The irony is that Cuebot-K appeared at exactly the same time that WGA - the software it was pretending to be - was being criticized for being no different from spyware.

This software collects data about software and hardware in a user's computer and collects it with a database of authorized operating systems. If it finds pirated Windows, it will "spread the word" to headquarters. Microsoft will then warn users and cut off some free download services for them.

Thien Y