Goner worm creates mass havoc

The Goner worm spreads through e-mail by using a subject line beginning with "Hi". In addition to its high propagation rate, it also carries a destructive payload.

  • E-Mail
By  Vijaya George Published  December 5, 2001

A mass-mailing virus called W32.Goner.A@mm, written in visual basic is said to have caused much havoc by spreading through the ICQ network as well as by email using Microsoft Outlook or through mIRC.

If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks. It finds certain files in memory and then terminates the processes of these found files. Thereafter, it executes its destructive payload of deleting files. E-mails with this worm usually come with “hi” in the subject line. The name of the attachment is Gone.scr and it is 38,912 bytes. When the infected mail is opened, the worm looks up the Microsoft Outlook address book and sends itself to all the addresses in there.

The worm has been packed using a known Portable Executable (PE) packer. It adds an additional value to the registry key and will terminate the processes of common anti-virus and firewall products found on the computer.

For more information, click here

Add a Comment

Your display name This field is mandatory

Your e-mail address This field is mandatory (Your e-mail address won't be published)

Security code