Win32/Goner.A

Win32/Goner.A is a worm written in Visual Basic, compressed by means of the utility UPX. It spreads by means of email file attachment with the subject "Hi".  The message body is formed by the following text:

How are you ?
When I saw this screen saver, I immediately thought about you
I am in a harry, I promise you will love it!

The worm itself is hidden in the attached file Gone.scr.  When it is run the following window is displayed:

The worm ensures its activation by registering the file Gone.scr which is located in the Windows system directory into the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run in registers.  Finally the worm displays a window with a fake erroneous message:

The worm turns off and deletes some programs as for example personal firewall Zone Alarm and it tries to spread also as the script ICQ.  To remove the worm delete the file Gone-scr in the abovementioned registers key and then delete also the file itself in the Windows system directory.

PROTECT YOUR COMPUTER!
ESETs NOD32 antivirus software provides comprehensive, easy-to-use, and affordable protection from todays and tomorrows threats. We put the malware expert inside the software, so you don’t have to become one.

DOWNLOAD ESET NOD32 ANTI VIRUS SOFTWARE