Name: W32.Goner.A@mm
Category: 3
Virus Definitions: December 04, 2001
Type: Worm
Aliases: WORM_GONE.A, W32/Goner-A
W32.Goner.A@mm is a mass-mailing worm written in Visual Basic. The worm has
also been compressed using a known file compressor. The worm can also spread
it's infection using the ICQ and IRC network.
Infection Length: 38,912 bytes
Send itself to all users in Outlook Address Books. Attemps to delete NAV
when the machine is restarted.
Subject of email: Hi
Name of attachment: Gone.scr
Size of attachment: 38Kbytes
The worm will also add a registry key called C:\%SYSTEM%\gone.scr (where
%SYSTEM% is the path to the Windows\System folder). The key will have the
same value as the name. It will be located in
HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
REF:
http://securityresponse.symantec.com/avcenter/venc/data/
[email protected] Your machine will be included if you have NAV CE (Norton
AntiVirus Corporate Edition) and your computer is on the network. The
current definition version is 31124b dated 11/24/01. /
REMEMBER: When you receive any email that has an attachment, be very
careful. Unless you are 100% positive that it is not a virus, even if you
know the person that is sending it to you, DO NOT OPEN THE ATTACHMENT,