Worm Pretends It's a Windows Program

A newly discovered worm, pretending to be Microsoft's Windows Genuine Advantage program, is being used by hackers to install malicious software on personal computers.

The worm, a program that spreads itself throughout an infected PC, is being sent via Time Warner's AOL Instant Messenger software, said Ronald O'Brien, senior analyst at Abingdon, U.K.-based Sophos. Closely held Sophos first warned about it on 3 July.

Once installed on a PC, the worm copies itself into a Windows system folder, creates a new file displayed as "Windows Genuine Advantage Validation Notification" and becomes part of the computer's automatic startup, O'Brien said.

Kjersti Gunderson, with Microsoft, said the next version of Microsoft's Malicious Software Removal Tool, to be released Tuesday, will scan for and clean the so-called Backdoor: Win32/IRCbot.R worm.

Microsoft's Windows Genuine Advantage software checks to see that users have licensed copies of Windows before allowing them to download important updates onto their PCs.