Warning

 

Close

Confirm Action

Are you sure you wish to do this?

Confirm Cancel
BCM
User Panel

Site Notices
Posted: 12/4/2001 11:09:39 AM EDT
My lab just got hit with it be carefull
subject of email   Hi
attachment   Goner.scr
size 38kb


In the last 5 mins got 25 emails with this virus
Link Posted: 12/4/2001 11:12:23 AM EDT
[#1]

[url]http://news.excite.com/news/r/011204/13/net-tech-worm-dc[/url]
Link Posted: 12/4/2001 11:12:46 AM EDT
[#2]
It's a nasty one.

Take a look at:[url] http://vil.mcafee.com/dispVirus.asp?virus_k=99272&[/url]

Av.
Link Posted: 12/4/2001 11:28:30 AM EDT
[#3]
Ok, I am working the help desk for our network today, was reading the flash e-mail on this new virus when *ring*

"Help desk."

"Umm, I think I got a virus."

"Let me guess, you opened goner.scr."

"Yup."

"Please turn off your pc."

Why do all these yahoos open every d^&n attachment?!?!  Update your virus defs now!
Link Posted: 12/4/2001 11:45:48 AM EDT
[#4]
It's all over here at work. I am sending everyone in my group who opened it home without pay for the rest of the week. [pissed]

Anyone who does it again gets sacked!
Link Posted: 12/4/2001 11:55:28 AM EDT
[#5]
I just got done cleaning up our company (actually my guys did all the work).  Even my boss (the CTO) got suckered into this one.  Human nature at it's best.  If someone says they "need your advice"  or "thought of you" you could name the damn thing virus.death and people will still open it.  Time to call it a day and drink a few Lagers.
Link Posted: 12/4/2001 11:58:46 AM EDT
[#6]
Name: W32.Goner.A@mm
Category: 3
Virus Definitions: December 04, 2001
Type: Worm
Aliases: WORM_GONE.A, W32/Goner-A

W32.Goner.A@mm is a mass-mailing worm written in Visual Basic. The worm has
also been compressed using a known file compressor. The worm can also spread
it's infection using the ICQ and IRC network.

Infection Length: 38,912 bytes

Send itself to all users in Outlook Address Books. Attemps to delete NAV
when the machine is restarted.

Subject of email: Hi
Name of attachment: Gone.scr
Size of attachment: 38Kbytes

The worm will also add a registry key called C:\%SYSTEM%\gone.scr (where
%SYSTEM% is the path to the Windows\System folder). The key will have the
same value as the name. It will be located in
HKLM\Software\Microsoft\Windows\CurrentVersion\Run.

REF:
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]


Your machine will be included if you have NAV CE (Norton
AntiVirus Corporate Edition) and your computer is on the network. The
current definition version is 31124b dated 11/24/01. /
REMEMBER: When you receive any email that has an attachment, be very
careful. Unless you are 100% positive that it is not a virus, even if you
know the person that is sending it to you, DO NOT OPEN THE ATTACHMENT,
Link Posted: 12/4/2001 11:59:26 AM EDT
[#7]
Ramblin
Can you beleive how stupid some yahoos are the ADMINS here at our place sent a warning after the first person opened it here and the IDIOTS are still opening the damn thing I just got 5 more while I was writing this
Link Posted: 12/4/2001 12:18:42 PM EDT
[#8]
Yep. Lecturing and meetings and email warnings hasn't worked, so I'm hitting them in the wallet. Money talks, especially right before Christmas.
Link Posted: 12/4/2001 12:48:16 PM EDT
[#9]
Yep, we got hit with it.  People are just too quick to clicky clicky!

I received a little over 100 e-mails in about 10 minutes.  They finally had to shut down the server.
Link Posted: 12/4/2001 12:52:59 PM EDT
[#10]
"Users are losers"
Link Posted: 12/4/2001 2:12:14 PM EDT
[#11]
I got about 30 of these in the last hour or so.  It clogged up our mail system.

I blame Outlook for this.  If you are reading a new message and delete it, the next message is automatically opened.  Even if users are careful, they could still get hit.  That is why I mostly use Pine.
Close Join Our Mail List to Stay Up To Date! Win a FREE Membership!

Sign up for the ARFCOM weekly newsletter and be entered to win a free ARFCOM membership. One new winner* is announced every week!

You will receive an email every Friday morning featuring the latest chatter from the hottest topics, breaking news surrounding legislation, as well as exclusive deals only available to ARFCOM email subscribers.


By signing up you agree to our User Agreement. *Must have a registered ARFCOM account to win.
Top Top