Worm Alert! Be on the lookout for the 'Goner' worm! (12/4/01)

Question

Worm Alert! Be on the lookout for the 'Goner' worm! (12/4/01)

Answer

This question was answered on December 4, 2001. Much of the information contained herein may have changed since posting.

W32.Goner.A@mm is a mass-mailing worm written in Visual Basic that is in high distribution. The worm can also spread it's infection using the ICQ and IRC networks, so be on the lookout for it.

For the time being, this is what we know about the worm:

Subject: Hi

Body: How are you ?

When I saw this screen saver, I immediately thought about you

I am in a harry, I promise you will love it!

Name of attachment: Gone.scr

Size of attachment: 38Kbytes

If you open this attached file it will infect your system immediately and attempt to remove popular anti-virus programs as well as firewall software from your system.

For specific detection and removal instructions go to:

Norton Anti-virus SARC alert:

<a href="http://www.sarc.com/avcenter/venc/data/w32.goner.a@mm.html" target="_blank"><font color="#003399">>http://www.sarc.com/avcenter/venc/data/w32.goner.a@mm.html</font></a>

McAfee Anti-virus alert:

<a href="http://www.mcafee.com/anti-virus/viruses/goner/default.asp?cid=2636" target="_blank"><font color="#003399">>http://www.mcafee.com/anti-virus/viruses/goner/default.asp?cid=2636</b></font></a>

For complete instructions on how to avoid these types of worms, go to:

<a href="http://www.computerproblems.com/kenscolumns.cfm?ColumnID=122" target="_blank"><font color="#003399">>http://www.computerproblems.com/kenscolumns.cfm?ColumnID=122</b></font></a>

Author

Posted by Ken of Data Doctors on December 4, 2001