Goner virus spreads, attacks antivirus wares
- — 05 December, 2001 08:45
If you opened the latest virus making the rounds Tuesday, your computer's antivirus system could be a goner.
The W32.Goner.A@mm or "Goner" virus is disguised as a screensaver that comes attached to an e-mail message. When the recipient opens the attachment, the virus activates and seeks out any locally installed antivirus and personal firewall software. It then attempts to erase all the files in the directory where the software is installed.
Goner spreads by e-mailing itself to every user listed in an Outlook address book on the infected machine and possibly via IRC and ICQ chat applications, says Ian Hameroff, business manager for security solutions at Computer Associates International Inc.
The virus may not be that successful in deleting an application's files because it is not an uninstall program; it just attempts a delete command. "The success depends on permissions setting and other environmental issues," Hameroff says.
The infecting e-mail comes with a subject line of "hi" and an attachment called "gone.scr." The body of the message says:
How are you ?
When I saw this screen saver, I immediately thought about you!
I am in a harry, I promise you will love it!
Computer Associates began receiving reports of the virus from European customers early Tuesday morning and later in the U.S. It currently rates the threat as moderate. "It's not the epidemic that BadTrans and Nimda were," Hameroff says.
All the major virus vendors, including Computer Associates, McAfee and Symantec Corp., are posting new definition files to fend off the Goner threat.