AOL instant messenger worm poses as Microsoft's Windows Genuine Advantage

Researchers at Sophos said the WGA worm, known as Cuebot-K, spreads by AOL Instant Messenger and registers itself as a new system driver service named wgavn.

The malware uses Windows Genuine Advantage Validation Notification as a display name and runs during system startup, according to Sophos. The worm then disables the Windows firewall and opens a backdoor to infected PCs, which allows malicious users to gain remote access or launch DDoS attacks.

Graham Cluley, senior technology consultant at Sophos, said the worm deceives users by appearing to be helpful software.

"People may think they have been sent the file from one of their AOL IM buddies, but in fact the program has no friendly intentions. Technical Windows users wouldn’t be surprised to see WGA in their list of services and so may not realize that the worm is using that name as a cloak to hide the fact that it has infected the PC," he said. "Once in place, this malware disables the firewall and opens a backdoor by which hackers can gain control over your computer to steal, spy and launch DDoS attacks."

Microsoft was hit with its second lawsuit in as many weeks over WGA as two companies and three residents from Washington state filed motions claiming the software violated spyware regulations.

Microsoft has issued new versions of WGA and has published directions on how to uninstall the program altogether.