Goner Screensaver Virus Infection Rivals Lovebug

Wednesday, 5 December 2001, 10:53 am
Article: Alastair Thompson

This morning Scoop HQ received what looks likely to be the first of many copies of the latest global virus, Goner. Goner pretends to be screensaver, and, according to the experts is rivalling the Lovebug in its rate of infection in the Northern Hemisphere.

If history is any guide then the virus will hit NZ hard too, starting about now.

The Goner virus appears with the Subject line “Hi”.

Inside the text reads:

“How are you ?
When I saw this screen saver, I immediately thought about you
I am in a harry, I promise you will love it!”

And the message contains the attachment gone.scr, a file type known as a “portable executable”, which means that it will run over all variations of the Windows Operating system including 95, 98, ME, NT and 2000.

Once opened the attachment immediately starts its mischief.

Symantec reports the full symptoms – and a disinfection method - at the following link.
http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm.html

In summary Goner:

- displays a cryptic message window headed “pentagone”;
- starts iterating the Microsoft Outlook address book and sends itself to all addresses in the address book;
- attempts to disable any virus protection;
- infects ICQ and MIRC applications;
- displays an error message.

The Goner virus comes hot on the heels of the Badtrans virus which Scoop HQ is presently receiving at the rate of five or six copies a day at present, and which nastily recorded passwords and emailed them off to its authors.

According to virus protection company Message Labs Goner is rivalling Lovebug in its rate of infection.

“MessageLabs have stopped many thousand copies of a new mass mailing worm. As at 19:40 GMT, over 30,000 copies have been stopped, and the worm was arriving at the rate of approximately 1 copy every 30 emails. This is comparable to the LoveBug, where the virus arrived at the rate of around 1 in 28 emails. As a comparison, most recent viruses have peaked at around 1 in 100 or 1in 150 emails.

The hour-by-hour graph below shows how the worm spread. It appeared to reach critical mass at around 15:30 GMT and then went into an explosive growth phase. As at 18:00 GMT over 14,000 copies of the virus had been stopped, and we therefore expect the graph below to take several hours to fully catch up. “

Be careful out there.

Scoop’s advice: Quit using Microsoft Outlook and start using Pegasus Mail or Eudora. Pegasus Mail http://pmail.com also has the virtue of having been written by a New Zealander!

ENDS

© Scoop Media

Alastair Thompson

Scoop Publisher

Alastair Thompson is the co-founder of Scoop. He is of Scottish and Irish extraction and from Wellington, New Zealand. Alastair has 24 years experience in the media, at the Dominion, National Business Review, North & South magazine, Straight Furrow newspaper and online since 1997. He is the winner of several journalism awards for business and investigative work.

Contact Alastair Thompson

• Linkedin
• Twitter - @althecat
• Facebook
• Email - alastair@scoop.co.nz