Alias:W32/Goner@MM
Type:Worm 
Size:38.912 Bytes 
Origin: 
Date:12-05-2001 
Damage:Spreads using ICQ Instant Messanger  
VDF Version:6.23.00.00 
Danger:Medium 
Distribution:Medium 

DistributionWorm/Goner spreads through ICQ, using standard ICQ components. It sends a request for file transfer to a connected user. If this allows the transfer, the worm is sent. The email has the following structure:

Subject: Hi
Body: How are you? When I saw this screen saver, I immediately thougt about youI am in a hurry, I promise you will love it!
Attachment: Gone.scr

Technical DetailsWorm/Goner copies itself as GONE.SCR in Windows system directory (usually C:\WINDOWS\SYSTEM\) and makes the autostart registry entry:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "C:\\WINDOWS\\SYSTEM\\GONE.SCR"="C:\WINDOWS\SYSTEM\GONE.SCR"

When the worm is activated, the following processes are terminated and the files deleted. If it fails, the files will be deleted by the next Windows start:

APLICA32.EXE
ZONEALARM.EXE
VSECOMR.EXE
WEBSCANX.EXE
AVCONSOL.EXE
VSSTAT.EXE
PW32.EXE
VW32.EXE
VP32.EXE
TDS2-98.EXE
TDS2-NT.EXE
ACINET32.EXE
PCFWallIcon.EXE
VPCC.EXE
VPM.EXE
AVPM.EXE
AVP32.EXE
AVP.EXE
LOCKDOWN2000.EXE
ICLOAD95.EXE
ICMON.EXE
ICSUPP95.EXE
ICLOADNT.EXE
ICSUPPNT.EXE
ESAFE.EXE
CFIADMIN.EXE
SCIAUDIT.EXE
FRW.EXE
VSHWIN32.EXE
SAFEWEB.EXE

When the attachment is opened, an animated dialog box is displayed and a message box with the text:
"Error While Analyze DirectX!"
Descrizione inserita da Crony Walker su martedì 15 giugno 2004

Indietro . . . .