Win32/Goner.A Worm

 Information about the Win32/Goner.A worm:

Win32/Goner is an email worm. This worm will infect Windows systems. It spreads using the email addresses present in MS-Outlook address book. The worm can spread through ICQ as well. The worm also tries to remove some firewall and anti-virus software installed on the infected computer.

Click here to download the FREE utility (CleanGN.EXE) to detect and remove the Win32/Goner.A worm from your computer.

The worm arrives as an attachment called gone.scr, disguising itself as a screen saver. The email carrying the worm has the following;

Subject : Hi

Body:

How are you ?
When I saw this screen saver, I immediately thought about you
I am in a harry, I promise you will love it!

Upon execution of the attachment, it displays a message box titled "About":

After this, another message box comes up with the title "Error":



It copies itself to windows system directory. The worm modifies registry to load itself at the next startup at the following location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The worm looks for the following security software processes running in the memory and disables them.

_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
APLICA32.EXE
AVP.EXE
AVP32.EXE
AVPCC.EXE
AVPM.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET32.EXE
ESAFE.EXE
FRW.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
LOCKDOWN2000.EXE
NAVW32.EXE
PCFWallICON.EXE
SAFEWEB.EXE
TDS2-98.EXE
TDS2-NT.EXE
VSHWIN32.EXE
ZONEALARM.EXE

The worm, after terminating these processes, deletes all the executable files in that folder, making the software unusable. If the folders are left undeleted, the worm drops a file WININIT.INI that will delete these folders in the next startup.

Later, it drops a file called ICQMAPI.DLL onto Windows System folder to send itself to ICQ users. It modifies MIRC.INI file of MIRC to activate the worm dropped REMOTE32.INI file.

This worm first appeared on 4th December 2001.

 Other names of Win32/Goner.A worm:

This worm is also known as I-Worm.Goner, Pentagone, W32/Goner-A, Gone.

 Removing Win32/Goner.A worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.