!!!ALERT!!! Virus Goner !!!ALERT!!!

I heard from a GREEK site that a new virus called: "GONER" will come to Europe from America by e-mails and chat with IRC. This virus will come to your computer by e-mail which have the subject "Hi" and a screensaver file as attachment. Then the virus send this mail again to everyone on your e-mail address book. It deletes all the system files to work the computer normal, also it deletes many famous antivirus programs such as Norton Anti-virus an close all the programms. Finally this virus makes a "connection" which attacks to servers with the method "denial of service".
THE END

This is important for ppl running Outlook, me running Linux and communicator wouldn't have to worry about **** like this doing any harm
offcourse most companies never learn and keep running Outlook.

i hear the latch of the stable door closing and the horse rampaging of in to the distance...

Quote:

---

Originally posted by Focmaester
This is important for ppl running Outlook, me running Linux and communicator wouldn't have to worry about **** like this doing any harm
offcourse most companies never learn and keep running Outlook.

---

Outlook is an excellent organization tool, why wouldn't a company use it?

I would be scared if I actually did a lot with e-mail. I obviously don't and you would know that if you have e-mailed me any time recently. I got like 200 messages in my in-box.

I think the best way to go is not to open e-mails from people you don't know. I have a very small list of friends that e-mail me so I don't have to worry. If you want to see any new e-mail viruses you can usually find some good information on pages like www.symantec.com. I don't go by rumors alone

This other one looks much more distructive rather than the minor annoyance of the self replicating W32/Goner-A

W32/Eira-A

W32/Eira-A is a mass-mailing internet worm that pretends to be a demo for the popular computer game Quake. It uses Microsoft Outlook and MAPI to spread.

When executed, the worm copies itself to C:\eiram\quake4demo.exe and F:\quake4demo.exe. To launch itself everytime Windows starts up, the worm creates the keys, "Q4" and "quake" under the Windows Registry sections: HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run. These keys point to the dropped copies of the worm.

The worm then emails itself to all the contacts in the victim's Outlook Address book with a randomly chosen subject and randomly constructed body.

The subject may be one of:

"Something very special",
"I know you will like this",
"Yes, something I can share with you",
"Wait till you see this!",
"A brand new game! I hope you enjoy it".

The body of the email is a combination of two or more of the following phrases:

"This is something you have to see!",
"Till next time",
"Is Internet that safe?",
"Hey you, take a look at the attached file. You won't believe your eyes when you open it!",
"You like games like Quake? You will enjoy this one.",
"Did you see the pictures of me and my battery operated boyfriend?",
"My best friend,",
"Check it out".

The worm may overwrite files with the extension OCX, EXE, XLS, DOC, MDB, HTM, HTML or TXT with a plain-text file containing the message:

"You've didn't protected your files well enough.

Let this be a lesson! Never trust someone else

eiram (1999-2001)"

'Goner' Worm Disrupts E-mail, Security Programs.
Tuesday, December 04, 2001
By Michael Y. Park

NEW YORK — Electronic security experts are warning of a powerful new computer worm that can do everything from send e-mail to delete virus programs to hack other machines, all from your own PC.


Disguised as an innocuous screensaver program from a thoughtful friend, the "Goner" worm appeared Tuesday morning and is on its way to becoming a worldwide epidemic — and computer-virus specialists are warning people to be on the alert.

"The subject line says 'Hi' and will be from someone you know," Symantec security response group manager Kevin Haley said. "The text will say 'How are you? I saw this screensaver and immediately thought of you.' That's a giveaway."

Needless to say, computer users are advised not to open the attached "screensaver" program, or they will unleash a computer worm that will delve through their e-mail address books, replicate itself and send itself out to all their friends.

Goner works through Microsoft programs like Outlook and Outlook Express and can send itself through instant-messaging services like ICQ and Internet Relay Chat.

But that's not the most insidious facet of the Goner worm's attack.

"It will put scripts into your system that will allow a hacker to go into your system and launch denial-of-service attacks on other computers," Haley said. "It will also delete your anti-virus and firewall programs."

This so-called "blended" attack — part traditional virus, part hack — is a sign that computer viruses are evolving to the next, more evolved step, he said. It leaves the back door open so that any hacker who knows where to look can go into an infected computer and use it for his own purposes.

"This is something we've been concerned about for a while," Haley said.

Goner was first reported in Europe — Symantec's first submission was from The Netherlands — but its point of origin remains unknown, Haley said. It has been rated a Level 3 by the Cupertino, Calif.-based company, but will likely earn a Level 4 threat rating by Wednesday morning because it is spreading so quickly, Haley said.

The highest threat level rated by Symantec is Level 5.

The McAfee security company gave "Goner" its "outbreak" status, last achieved by the "Love Letter" virus, which caused billions of dollars in damages worldwide.

"It's moving extremely quickly," said McAfee virus research manager April Goostree. "We're getting hundreds and hundreds of samples in a very short time."

The Associated Press contributed to this report.

------------------------------------------------------------------------------------

Here you can download a tool to see if you are infected and remove is neccessary.

http://securityresponse.symantec.com...oval.tool.html

Dont be scared of goner, and use common sense with your e-mail. Dont open any executable files or anything unless you know 100% what it is. Also virus scan it first. Also with all the problems in outlook, I would suggest finding a more secure e-mail program. Even when I used to use outlook express, I never kept names in the address book. Be sure to get a trojan blocking firewall up too.

[1] Don't store contacts in the Outlook Address Book
[2] Install & update an antivirus system
[3] Install a firewall such as Zone Alarm [www.zonelabs.com]
[4] Scan all e-mail attachments for viruses
[5] Don't open EXE files from e-mails until you're sure what they are and that they do not contain a virus
[6] Use common sense