Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Win32/Goner.A

Win32/Goner.A is a worm written in Visual Basic, compressed by means of the utility UPX. It spreads by means of email file attachment with the subject "Hi".  The message body is formed by the following text:

How are you ?
When I saw this screen saver, I immediately thought about you
I am in a harry, I promise you will love it!

The worm itself is hidden in the attached file Gone.scr.  When it is run the following window is displayed:

The worm ensures its activation by registering the file Gone.scr which is located in the Windows system directory into the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run in registers.  Finally the worm displays a window with a fake erroneous message:

The worm turns off and deletes some programs as for example personal firewall Zone Alarm and it tries to spread also as the script ICQ.  To remove the worm delete the file Gone-scr in the abovementioned registers key and then delete also the file itself in the Windows system directory.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.