Well it didn't take too long for the malware writers to craft a bit of nastiness that fakes Microsoft's WGA tool and notification files.

So far there are two instances one at AUMHA forums and DanisWeb Forum.

The malware guys insert it as a fake Windows service, calling it, as it appears in a HJT log file:

The correct file resides in the System32 folder and there is no service associated with it.

The name is also slightly different than the original MS ones:

• Windows Genuine Advantage Validation Tool
• Windows Genuine Advantage Notification Tool

Kudos to the many MS MVPS working on this to gather file information and registry changes, not to mention submit the files to all the appropriate vendors to be added to their definition databases.

All the above information was gathered by them and published among many blogs and websites.

I'll add a list of blog sites mentioning this soon as I collect some.

List of Blogs mentioning fake WGA Malware:
Spyware Confidential

Donna's Security Flash

Susan Bradley SMB Blog

Hmmm, well now there is competition for the "real" M$ spyware tool???

Hi Guys,

It would seem I'm a little late on this particular beastie. I haven't personally seen a sample of it yet. If any of you should happen to have it, and wouldn't mind sharing for addition to BugHunters database, I'd be grateful.

This is already in some av databases, it seemed to originate\spread via IM, see here

I think I may be able to get a copy, I'll have to ask around some. So far it's only been submitted to the av\anti-spyware vendors.

And there is also a new one called windowsvista.exe spreading around via P2P. And it's only recognised by a couple of av companies as of right now.

They're easily found if one hunts the likes of the FastTrack/Gnutella networks .... all you need is it's original filename (i.e. wgavn.exe) - some silly bugger always seems to be unawares that they're spreading infected crap.

Excellent. I'll have to a little p2p research, as I'm not loading kazaa to access it.

I picked up a nice lot of samples today from an infected machine. I've submitted one to virustotal, but after being put in que for 45 minutes, I determined it would be an all day thing to get them all up there.

Hi Raid,

You certainly don't need Kazaa to get into P2P.

You might try
LimeWire 4.1.3
License: Free
File size: 350.7K
Minimum requirements: Windows 95/98/Me/NT/2000/XP
Rating: 4 out of 5 Read the full review.

Cementing its role as the quintessential Gnutella client, LimeWire remains one of the most trusted P2P applications.
http://www.download.com/LimeWire/3000-2 ... 51892.html

Have fun!