Virus Alert: New Virus on the Loose
Hot on the heels of the Badtrans worm comes a new threat to the world's computer systems.
The Goner virus has "Hi" in the subject line, and e-mails itself out to all users in Outlook Address Books. It then attempts to delete several files, including anti-virus software.
Users are being told to delete the e-mail as soon as they receive it, and on no account open the Goner.scr attachment.
The mail reads, "When I saw this screen saver, I immediately thought about you. I am in a harry (sic), I promise you will love it."
Investigations are underway in Europe, where it is thought that the virus originated.
Goner is a mass-mailing worm that is written in Visual Basic. The worm has been compressed using a known Portable Executable (PE) file compressor. According to Internet security specialists at Symantic, PE files are files that are portable across all Microsoft 32-bit operating systems. The same PE-format executable can be executed on any version of Windows 95, 98, Me, NT, and 2000. Therefore, all PE files are executable, but not all executable files are portable.
A good example of a Portable Executable is a screen saver (.scr) file.
According to the Symantec site, the worm can spread its infection using the ICQ network as well as by e-mail using Microsoft Outlook. If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks.
A worm removal tool is available on the Symantec website.
Virus Alert: W32/BadTrans Worm Spreading