Q-C Online support pages
Technical support article

About the Goner virus "W32.Goner.A@mm"



W32.Goner.A@mm is a mass-mailing worm that is written in Visual Basic. The worm has been compressed using a known Portable Executable (PE)* file compressor. The worm can spread its infection using the ICQ network as well as by email using Microsoft Outlook. If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks.

The E-mail will most likely come to you from someone you know and will appear saying:
How are you?
When I saw this screensaver, I immediately thought about you
I am in a harry, I promise you will love it!

Once launched, W32.Goner.A@mm starts by displaying the following window.



The worm has been packed using a known Portable Executable (PE) packer. The size of the worm unpacked is approximately 159 KB. The worm adds the value: C:\%SYSTEM%\gone.scr to the registry key of HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
This virus an also infect your machine via ICQ and mIRC, two of the most popular chat clients. For more information on how these chat clients are infected, visit Norton Anti-virus W32.Goner.A@mm information

To remove this or any other virus, update your anti-virus software immediately and run a thorough scan of your machine. Your best defense against a virus is to always remember to never download any strange attachment, especially if you do not know who it is coming from. If you do not know what a specific attachment is, reply to the person who sent it to you and ask, do not download. Your second line of defense should be having, and running, an up to date Anti-Virus application. For more information on virus updates and anti-virus software, visit our Virus Information section.



Local events heading








 

(More History)