Goner Worm
Information
about Goner worm:
Goner
is an Internet worm uses Microsoft Outlook,
ICQ and mIRC to spread. The worm is
38,912 bytes long and written in Visual
Basic. It needs "MSVBVM60.dll"
to spread otherwise it will show dll
missing error. The e-mail attachment name
will be "Gone.scr". The worm is
also packed with UPX compressor.
While opening the
e-mail attachment, the worm will copy
"Gone.scr" to Windows System
folder. Then it changes the registry settings
so that Gone.scr is automatically
executed when the system is restarted.
When executed it will display an about
box and fake message box.
It opens the
Microsoft Outlook Address book and sends
email to all the email Ids stored. The
message subject will be "Hi", the
message body will be "How
are you ?
When I saw this screen saver, I
immediately thought about you I am in a
harry, I promise you will love it!"
Goner is also
spreads through ICQ Instant Messenger if
ICQ software is installed in the infected
machine. It also drops scripts to flood
few mIRC channels. It also looks for
anti-virus programs if found, it deletes
the entire folder.
Removing Goner
worm from your system:
Fire has
incorporated I-Worm/Goner into its virus
signature file, to protect its users from
this worm attack. Fire anti-virus users
can use online update
facility to update signature file. If you
are already infected with this worm, run
Fire anti-virus and choose delete option
to remove the worm components.
You
can check the system manually.
I-Worm/Goner creates the file "Gone.scr"
in the Windows System folder.
The presence of this file ensures you are
infected with this worm. A free download is available to detect
and clean this
worm.
A
free download
of FireLite
[ 1100KB]
version is also available to detect all
viruses including Goner worm. If you find
this worm, use registered version of Fire
to remove. Fire anti-virus kit
provides perfect cure for Goner worm.
To get the registered version of Fire
call us at 044-28170440 or mail
to service@fireav.com
or
purchase Fire online using 
[Analysis:
Mr.Ramesh, Mr. Stanley Rakesh, Prognet
Technologies Pvt. Ltd, Dec 2001]
|
.