W32.Goner.A@mm VIRUS

Discovered on: December 4, 2001

Last Updated on: December 4, 2001 at 06:23:06 PM PST

Due to the increased rate of submission and level of damage, Symantec Security Response is upgrading W32.Goner.A@mm from Category 3 to Category 4.
W32.Goner.A@mm is a mass-mailing worm that is written in Visual Basic. The worm has been compressed using a known Portable Executable (PE)* file compressor. The worm can spread its infection using the ICQ network as well as by email using Microsoft Outlook. If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks.

Removal Tool
Symantec Security Response has posted a removal tool to assist in eradicating this worm. Please go here to read the instructions and download the removal tool.

Type: Worm

Infection Length: 38,912 bytes

Virus Definitions: December 4, 2001

Threat Assessment:

Wild:
High Damage:
Medium Distribution:
High

Damage:

Payload: Upon execution
- Large scale e-mailing: Send itself to all users in Outlook Address Books
- Deletes files: Attemps to delete several files, including NAV

Distribution:

Technical description:

W32.Goner.A@mm starts by displaying the following window.

In the background, the worm starts iterating the Microsoft Outlook address book and sends itself to all addresses in the address book. The email appears as follows.

The worm has been packed using a known Portable Executable (PE) packer. The size of the worm unpacked is approximately 159 KB.

The worm adds the value

C:\%SYSTEM%\gone.scr C:\%SYSTEM%\gone.scr

to the registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

NOTES:

%SYSTEM% is the path to the Windows System folder. In most cases this would be C:\Windows\System; however, the location could be different if the Windows System folder has been installed to a different location.
The key has the same value as the name of the file that is being called.

Once the registry key has been added, the worm will try to delete files of common anti-virus and firewall products. Security Response is continuing to verify the list of files which the worm attempts to delete. Once this information is verified it will be made available. If the files are in use and cannot be deleted, the worm will create the file %SYSTEM%\Wininit.ini, which causes the files to be deleted when the computer restarts.

W32.Goner.A@mm is capable of spreading over the ICQ network. If ICQ is installed on an infected machine, the worm will do the following:

1. Check for the version of the ICQ .dll file that contains the APIs that will be used. If the correct version is found, the worm proceeds.
2. Disable all notification. This means that the user cannot see what the worm is doing in the background.
3. Retrieve a list of all "buddies" who are currently online.
4. Retrieve information about each user individually. This information is required to be able to send files.
5. Send itself to all users on the list.
6. Re-enable all notifications.

If mIRC is installed, this worm can insert scripts into the mIRC folder. This allows the computer to be used in DOS attacks.

Finally, the worm displays the following fake error message:

Removal instructions:

Symantec Security Response has posted a removal tool to assist in eradicating this worm. Please go here to read the instructions and download the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@mm.removal.tool.html

Manual Removal
To manually remove this worm, you must restart the computer in Safe mode or end the process on the part of the worm that is running in memory. Then reverse the changes that the worm made to the registry, restart the computer, reinstall Norton AntiVirus, and then run a full system scan and delete all infected files. Detailed instructions follow.

Follow the instructions for your version of Windows.

Windows 95/98/Me
Because the worm file may be in use, you must restart in Safe mode to remove the changes made to the registry.

CAUTION: (For Windows Me users only.) If you are running Windows Me, follow the instructions in the section System Restore option in Windows Me at the end of this document before you begin the removal procedure.

Restart the computer in Safe mode by following the instructions in How to restart Windows 9x or Windows Me in Safe mode.

NOTE: Shut down the computer for a full 30 seconds before restarting in Safe Mode to make sure the worm has been cleared from memory.

Windows NT/2000/XP
Because the worm file may be in use, you must End Process on the worm files before the registry value can be removed.

1. Press Ctrl+Alt+Delete one time.
2. Click Task Manager.
3. Click the Processes tab.
4. Click the "Image Name" column header two times to sort the processes alphabetically.
5. Scroll through the list and look for gone.scr. If you find the file, click it and then click End Process.
6. Scroll through the list and look for pentagone. If you find the file, click it and then click End Process.
7. Close the Task Manager.

Edit the registry

CAUTION: We strongly recommend that you back up the system registry before you make any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure that you modify only the keys that are specified. Please see the document How to back up the Windows registry before you proceed. This document is available from the Symantec Fax-on-Demand system. In the U.S. and Canada, call (541) 984-2490, select option 2, and then request document 927002.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
4. In the right pane, delete the following value:

C:\%SYSTEM%\gone.scr C:\%SYSTEM%\gone.scrNOTE: %SYSTEM% is the path to the Windows System folder. In most cases this would be C:\Windows\System; however, the location could be different if the Windows System folder has been installed to a different location.

5. Click Registry, and click Exit.
6. Restart the computer.
7. Reinstall NAV, and restart the computer.

Remove the worm files

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. Delete all files that are detected as W32.Goner.A@mm. Deleted files must be either replaced from a clean backup or reinstalled.

Reinstall your firewall product, if needed.

Additional information:

*What are Portable Executable (PE) files?
PE files are files that are portable across all Microsoft 32-bit operating systems. The same PE-format executable can be executed on any version of Windows 95, 98, Me, NT, and 2000. Therefore, all PE files are executable, but not all executable files are portable.

A good example of a Portable Executable is a screen saver (.scr) file.

System Restore option in Windows Me
One of the new features of Windows Me is System Restore. This feature, which is enabled by default, is used by Windows to restore files on your computer in case they become damaged. Windows Me keeps the restore information in the _RESTORE folder. A _RESTORE folder is created on each hard drive on the computer; these folders are updated when the computer restarts.

If the computer is infected with W32.Goner.A@mm, then it is possible that the worm could be backed up in the _RESTORE folder. By default, Windows prevents System Restore from being modified by outside programs. Because of this, any repair attempts made by the removal tool will fail. To work around this, you must disable System Restore and restart the computer. This will purge the contents of the _RESTORE folder. You must then run the removal tool again.

To disable System Restore:
Follow the steps listed below the following figure. Use the numbers in the figure for reference.

1. Close all open programs. Then right-click My Computer on the Windows desktop
2. Click Properties.
3. Click the Performance tab.
4. Click File System.
5. Click the Troubleshooting tab.
6. Check Disable System Restore.
7. Click OK.
8. Click OK.
9. Click Yes to restart. The System Restore feature is disabled and the contents of the _RESTORE folder are purged when the system is restarted.

NOTE: After following all of the removal instructions, repeat steps 1 through 9, except in step 6 uncheck Disable System Restore.

You can find an additional information in the document Cannot repair, quarantine, or delete a virus found in the _RESTORE folder.

For additional information and an alternative to disabling System Restore, see the Microsoft Knowledge Base article Anti-Virus Tools Cannot Clean Infected Files in the _Restore Folder, Article ID: Q263455.

Write-up by: Neal Hindocha

Symantec AntiVirus Research Center (SARC)
http://www.symantec.com