Goner Worm

A mass-mailing worm called W32.Goner.A@mm was discovered December 4, 2001.

If your system has become infected, a removal tool is available at http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm.html

From the SARC Site:

Due to the increased rate of submission and level of damage, Symantec Security Response is upgrading W32.Goner.A@mm from Category 3 to Category 4.

W32.Goner.A@mm is a mass-mailing worm that is written in Visual Basic. The worm has been compressed using a known Portable Executable (PE)* file compressor. The worm can spread its infection using the ICQ network as well as by email using Microsoft Outlook. If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks

DAMAGE:

	Payload: Upon execution
	Large scale e-mailing: Send itself to all users in Outlook Address Books
	Deletes files: Attempts to delete several files, including NAV
	Distribution:
	Subject of email: Hi
	Name of attachment: Gone.scr
	Size of attachment: 38,912 bytes

Details and removal instructions are available at http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm.html