Worm/Goner - Worm

See also

Full description

Alias:	W32/Goner@MM
Type:	Worm
Size:	38.912 Bytes
Origin:
Date:	12-05-2001
Damage:	Spreads using ICQ Instant Messanger
VDF Version:	6.23.00.00
Danger:	Medium
Distribution:	Medium

DistributionWorm/Goner spreads through ICQ, using standard ICQ components. It sends a request for file transfer to a connected user. If this allows the transfer, the worm is sent. The email has the following structure:

Subject: Hi
Body: How are you? When I saw this screen saver, I immediately thougt about youI am in a hurry, I promise you will love it!
Attachment: Gone.scr

Technical DetailsWorm/Goner copies itself as GONE.SCR in Windows system directory (usually C:\WINDOWS\SYSTEM\) and makes the autostart registry entry:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "C:\\WINDOWS\\SYSTEM\\GONE.SCR"="C:\WINDOWS\SYSTEM\GONE.SCR"

When the worm is activated, the following processes are terminated and the files deleted. If it fails, the files will be deleted by the next Windows start:

APLICA32.EXE
ZONEALARM.EXE
VSECOMR.EXE
WEBSCANX.EXE
AVCONSOL.EXE
VSSTAT.EXE
PW32.EXE
VW32.EXE
VP32.EXE
TDS2-98.EXE
TDS2-NT.EXE
ACINET32.EXE
PCFWallIcon.EXE
VPCC.EXE
VPM.EXE
AVPM.EXE
AVP32.EXE
AVP.EXE
LOCKDOWN2000.EXE
ICLOAD95.EXE
ICMON.EXE
ICSUPP95.EXE
ICLOADNT.EXE
ICSUPPNT.EXE
ESAFE.EXE
CFIADMIN.EXE
SCIAUDIT.EXE
FRW.EXE
VSHWIN32.EXE
SAFEWEB.EXE

When the attachment is opened, an animated dialog box is displayed and a message box with the text:
"Error While Analyze DirectX!"

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back