Virus Alert: Gonner

[LadyDarkFire]

Virus Alert: Goner

If you get a file attatchment that states it's a Screen Saver and "You will love it" do NOT Open it. There is a new Virus, "Goner" that appears to do some nasty things.

[Edit to stop myself from looking like a complete and utter fool]

 

[modest mouse]

I believe it is actually 'Goner'.

 

[LadyDarkFire]

Shoot Me Now. Sorry about that, typing faster than I think again.

 

[Mellon Collie]

I believe it is actually 'Goner'.

*cough* thread nazi *cough*

 

[modest mouse]

*cough* thread nazi *cough*

MC, your punk ass is mine. I was makeing sure people new the name of the virus, just an assist to LadyDarkFire. I think you should back off before I get nasty.

Got it?

 

[Mellon Collie]

MC, your punk ass is mine. I was makeing sure people knew the name of the virus, just an assist to LadyDarkFire. I think you should back off before I get nasty.

Got it?

You are so mean to me.

 

[Dillinger]

W32.Goner.A@mm

W32.Goner.A@mm is a mass-mailing worm that is written in Visual Basic. The worm has been compressed using a known Portable Executable (PE)* file compressor. The worm can spread its infection using the ICQ network as well as by email using Microsoft Outlook. If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks.

Check it out here - http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm.html

Removal instructions:

To remove this worm, you must restart the computer in Safe mode or end the process on the part of the worm that is running in memory. Then reverse the changes that the worm made to the registry, restart the computer, reinstall NAV, and then run a full system scan and delete all infected files. Detailed instructions follow.

Follow the instructions for your version of Windows.

Windows 95/98/Me
Because the worm file may be in use, you must restart in Safe mode to remove the changes made to the registry.

CAUTION: (For Windows Me users only.) If you are running Windows Me, follow the instructions in the section System Restore option in Windows Me at the end of this document before you begin the removal procedure.

Restart the computer in Safe mode by following the instructions in How to restart Windows 9x or Windows Me in Safe mode.

NOTE: Shut down the computer for a full 30 seconds before restarting in Safe Mode to make sure the worm has been cleared from memory.

Windows NT/2000/XP
Because the worm file may be in use, you must End Process on the worm files before the registry value can be removed.

1. Press Ctrl+Alt+Delete one time.
2. Click Task Manager.
3. Click the Processes tab.
4. Click the "Image Name" column header two times to sort the processes alphabetically.
5. Scroll through the list and look for gone.scr. If you find the file, click it and then click End Process.
6. Scroll through the list and look for pentagone. If you find the file, click it and then click End Process.
7. Close the Task Manager.


Edit the registry

CAUTION: We strongly recommend that you back up the system registry before you make any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure that you modify only the keys that are specified. Please see the document How to back up the Windows registry before you proceed. This document is available from the Symantec Fax-on-Demand system. In the U.S. and Canada, call (541) 984-2490, select option 2, and then request document 927002.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

4. In the right pane, delete the following value:

C:\%SYSTEM%\gone.scr C:\%SYSTEM%\gone.scr

NOTE: %SYSTEM% is the path to the Windows System folder. In most cases this would be C:\Windows\System; however, the location could be different if the Windows System folder has been installed to a different location.

5. Click Registry, and click Exit.
6. Restart the computer.
7. Reinstall NAV, and restart the computer.


Remove the worm files

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. Delete all files that are detected as W32.Goner.A@mm. Deleted files must be either replaced from a clean backup or reinstalled.


Reinstall your firewall product, if needed.

Additional information:

*What are Portable Executable (PE) files?
PE files are files that are portable across all Microsoft 32-bit operating systems. The same PE-format executable can be executed on any version of Windows 95, 98, Me, NT, and 2000. Therefore, all PE files are executable, but not all executable files are portable.

A good example of a Portable Executable is a screen saver (.scr) file.

System Restore option in Windows Me
One of the new features of Windows Me is System Restore. This feature, which is enabled by default, is used by Windows to restore files on your computer in case they become damaged. Windows Me keeps the restore information in the _RESTORE folder. A _RESTORE folder is created on each hard drive on the computer; these folders are updated when the computer restarts.

If the computer is infected with W32.Goner.A@mm, then it is possible that the worm could be backed up in the _RESTORE folder. By default, Windows prevents System Restore from being modified by outside programs. Because of this, any repair attempts made by the removal tool will fail. To work around this, you must disable System Restore and restart the computer. This will purge the contents of the _RESTORE folder. You must then run the removal tool again.

To disable System Restore:
Follow the steps listed below the following figure. Use the numbers in the figure for reference.

1. Close all open programs. Then right-click My Computer on the Windows desktop
2. Click Properties.
3. Click the Performance tab.
4. Click File System.
5. Click the Troubleshooting tab.
6. Check Disable System Restore.
7. Click OK.
8. Click OK.
9. Click Yes to restart. The System Restore feature is disabled and the contents of the _RESTORE folder are purged when the system is restarted.

NOTE: After following all of the removal instructions, repeat steps 1 through 9, except in step 6 uncheck Disable System Restore.

 

[modest mouse]

You are so mean to me.

I'm not buying it MC, your sweetie-pie act has come to an end, I know the truth! You are a mean and hostile person, petty and manipulative! I want nothing to do with you.

 

[Mellon Collie]

I'm not buying it MC, your sweetie-pie act has come to an end, I know the truth! You are a mean and hostile person, petty and manipulative! I want nothing to do with you.

Fine.

 

[modest mouse]

Disclaimer.........

I feel the need to throw a in here 'cause it I dont want people to think MC and I have called off our marriage. You are all invited, its BYOB and will be held at MC's Philly home.

I'll keep you posted on the details, It looks like a go for early April. See you then.

 

[Mellon Collie]

Yay!

 

[modest mouse]

See folks, its all good.

 

[sabbathstorm]

I've had this virus sent to me in my Yahoo mail disguised as a webpage. The header on the mail involved SPAM cluttering up inboxes and how this site could help. Being in IT, I'm suspicious of damn near everything in email. I scanned it and found it was the virus. Just a heads up for all!