Worm Disguises As Windows Genuine Advantage be careful of the wgavn service ...

[bakuryu 0]

IT security experts have warned of a worm that purports to be Microsoft's Windows Genuine Advantage (WGA) anti-piracy tool.

 

WGA has recently been branded as 'spyware' in that it collects unnecessary hardware and software data from users' PCs.

 

The Cuebot-K worm spreads via AOL Instant Messenger, registering itself as a new system driver service called 'wgavn'. It carries the display name 'Windows Genuine Advantage Validation Notification', and runs automatically during system startup.

 

Once in place the worm disables the Windows firewall, and opens a backdoor to infected computers which allows hackers to gain remote access, spy on users, and potentially launch distributed denial-of-service attacks.

 

Source : http://forums.xisto.com/no_longer_exists/

So, any normal user even seeing a list of startup's or seeing the service list may not be suspecting anything since the worm disguises itself as the WGA service. Be careful of the wgavn service

 

Solution :

 

Run RemoveWGA for removing WGA. Still if you see any WGA service running, disable it and remove it from the services.msc list. And also search for the file and delete it.

Also have a look through Autoruns if you have any instance of wgavn present in your system during startup. After removal check your system again.

 

OR do not install WGA at all

 

Notice from serverph:

QUOTE tags added as needed.

[Florisjuh 0]

Hahahah, Microsoft found a new way to *BLEEP* the legal uses of windows up, now we will get worms and stuff because it's hidden as a microsoft service against hackers... just plain out *LOL*

[bakuryu 0]

And to add to MS trouble already within 4 days 2 lawsuits are filled against MS accusing the original WGA notification to be a spyware

[tdktank59 0]

well it is spyware they say its a critical update when its not...it gathers information on the users computer (spying...) then sends it back to microsoft thus why microsoft cant take the removal tool off the network because of this...

[delivi 0]

It is a new measure taken by Microsoft to prevent the Piracy of Windows. But poor guy if we download it we'll face a lot of problems.

[FirefoxRocks 0]

I just downloaded Windows Genuine Advantage a few days ago. No spyware found on my system.Hmm...is Windows XP really a piracy threat? I don't really think so. Microsoft Office is much more of a piracy threat than Windows XP, if at all.Without Windows Genuine Advantage, a lot of things cannot be downloaded.