Hi everyone

Just a quick note regarding the latest Virus which attempts to delete any Anti Virus Software that you may have running on your PC. Below is a description:-


W32/Goner-A
Aliases
I-Worm.Goner, Gone, W32/Goner@MM, Pentagone

Type
Win32 worm

Description
W32/Goner-A spreads by email as a file attachment called GONE.SCR. It uses this name to pose as a screensaver. The worm arrives in an email with the following characteristics:

Subject: Hi

Message text:
How are you ?
When I saw this screen saver, I immediately thought about you I am in a harry, I promise you will love it!

W32/Goner-A attempts to disable anti-virus products installed on the infected computer. It does this by looking for the following processes:

APLICA32.EXE
AVCONSOL.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPM.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET32.EXE
ESAFE.EXE
FRW.EXE
FEWEB.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
LOCKDOWN2000.EXE
PCFWallIcon.EXE
PW32.EXE
TDS2-98.EXE
TDS2-NT.EXE
VP32.EXE
VPCC.EXE
VPM.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSSTAT.EXE
VW32.EXE
WEBSCANX.EXE
ZONEALARM.EXE

If the worm finds one of the above processes, it will attempt to terminate it. The worm will also attempt to delete all files from any directory containing files of those names, and creates a file called wininit.ini in order to delete any remaining files the next time Windows is restarted.

The worm also deletes all files from C:\SAFEWEB\

The worm creates a copy of itself named gone.scr in the Windows System directory. In order to ensure that the worm is run each time Windows is restarted it creates a registry key containing the name of the worm file in

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

When the worm is run for the first time, it shows a short graphical display and then displays a bogus error message. This is designed to fool the recipient into believing they received a genuine screensaver and that it has aborted for some reason.

Please check your Anti Virus and update the software as soon as possible.

David