http://seattlepi.nwsource.com/business/276555_worm06.html
Hackers use new worm to infect PCs Virus pretends it's Windows Genuine Advantage BLOOMBERG NEWS A newly discovered worm, pretending to be Microsoft Corp.'s Windows Genuine Advantage program, is being used by hackers to install malicious software on personal computers. The worm, a program that spreads itself throughout an infected PC, is being sent by way of Time Warner Inc.'s AOL Instant Messenger software, said Ronald O'Brien, senior analyst at Abingdon, U.K.-based Sophos Plc. Closely held Sophos first warned about the worm Monday. Once installed on a PC, the worm copies itself into a Windows system folder, creates a new file displayed as "Windows Genuine Advantage Validation Notification" and becomes part of the computer's automatic startup, O'Brien said. Hackers can use the software to gain control of the PC, grab confidential information and create denial of service attacks against targeted Web sites, according to Sophos. "The worm is using the Genuine Advantage identity as a means of convincing users of its validity," O'Brien said from Lynnfield, Mass., where Sophos has a U.S. office. Kjersti Gunderson, a spokeswoman for Microsoft, said the next version of Microsoft's Malicious Software Removal Tool, to be released Tuesday, will scan for and clean the so-called Backdoor: Win32/IRCbot.R worm. Microsoft's Windows Genuine Advantage software checks to see that users have licensed copies of Windows before allowing them to download important updates onto their PCs. Microsoft's security advisory about the worm can be found at: www.microsoft. com/security/encyclopedia/details.aspx?name. Reply with a "Thank you" if you liked this post. _____________________________ MEDIANEWS mailing list [email protected] To unsubscribe send an email to: [EMAIL PROTECTED]
