WORM_GONE.A (High Risk)

[Memnoch]

The Worm
This worm arrives via email as the attachment GONE.SCR. The file is packed using the UPX packer program and is compiled using Visual Basic.

The email details in which this Worm arrives are as follows:

Subject: Hi
Message Body: How are you ?
When I saw this screensaver, I immediately thought about you
I am in a harry, I promise you will love it!
Attachment: GONE.SCR

It creates an Outlook Application Object, and uses MAPI script commands to create and send bogus emails to all recipients in the infected user's address book. Thereafter, it deletes these bogus emails.
When executed, it displays a window containing the following:

pentagone

coded by: suid

texted by: ThE_SKuLL and |satan|
greetings to: TraceWar, k9_unit, stef16 ^Reno

greetings also to nonick2 out
there where ever you are

It then copies the worm file to a %System%\GONE.SCR file. It creates the following registry key to auto-execute the copy file everytime Windows is restarted:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run\%System%\gone.scr = %System%\gone.scr

It also uses the mIRC application to install a backdoor. It creates a REMOTE.INI file, which contains a script that loads everytime the mIRC application is started. The Worm author can then use this Worm extension to start Denial of Service (DOS) attacks on IRC channels and/or users connected to the same IRC channel as the infected user.
The Worm also propagates via the ICQ chat application. It uses the ICQAPI to send a copy of itself to ICQ users.

The Payload
The Worm contains a destructive payload, which runs through all running processes in memory. It terminates from memory any running process associated with the following filenames:

IAMAPP.EXE
IAMSERV.EXE
CFINET.EXE
APLICA32.EXE
ZONEALARM.EXE
ESAFE.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
CFINET32.EXE
PCFWALLICON.EXE
FRW.EXE
VSHWIN32.EXE
VSECOMR.EXE
WEBSCANX.EXE
AVCONSOL.EXE
VSSTAT.EXE
NAVAPW32.EXE
NAVW32.EXE
_AVP32.EXE
_AVPCC.EXE
_AVPM.EXE
AVP32.EXE
AVPCC.EXE
AVPM.EXE
AVP.EXE
ICLOAD95.EXE
ICMON.EXE
ICSUPP95.EXE
ICLOADNT.EXE
ICSUPPNT.EXE
TDS2-98.EXE
TDS2-NT.EXE
SAFEWEB.EXE
After terminating the files, it deletes these files including all the other files found in the directory where it found any of these files.

This effectively disables the applications, preventing the files from functioning properly.

The Stealth Routine
The main windows of the Worm bears the name, “pentagone.”

On Windows 9x, it registers itself as a service process not visible on the Task List. Despite its invisibility on the Task List, the Outlook Application Object that it opens is visible on the Task List.

To further prevent detection, it creates an entry in the WININIT.INI file with instructions that delete its currently running copy.

REMOVAL
-------------------------------------------------------------------------------
WORM_GONE.A
GONE.A, WORM_GONER.A

This Worm is a Visual Basic-compiled Windows executable, which propagates copies of itself via email using Microsoft Outlook and via ICQ.
It finds certain files in memory and then terminates the processes of these found files. Thereafter, it executes a destructive payload of deleting files.

Manual Cleaning On Windows 95/98/Me Systems:
1. Reboot the computer.
2. Before the startup logo appears, press F8.
3. Choose the “Command prompt only” option.
4. Go to the %System% directory. %Sys tem% is variable. It is usually located at C:\Windows\System.
5. At the command prompt, type the following command then hit the Enter key:
attrib –s –h –r gone.scr
6. Type the following command and then hit the Enter key to delete the Worm file:
del gone.scr
7. Restart the computer.
8. Double click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft
>Windows>CurrentVersion>Run>%System%
9. Look for the following registry entry and then delete it:
gone.scr
Manual Cleaning On Windows NT/2000 Systems:
1. Boot from a Windows 2000 CD and select the "repair install console."
2. Go to the %System% directory. %System% is variable. It is usually located at C:\Windows\System.
3. At the command prompt, type the following and then hit the Enter key:
attrib –s –h –r gone.scr
4. Type the following command and then hit the Enter key to delete the Worm file:
del gone.scr
5. Restart the computer.
6. Double click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft
>Windows>CurrentVersion>Run>%System%
7. Look for the following entry and delete it:
gone.scr

 

[Wargasm]

odd i just created a thread bout viri here

http://www.the-group.org/forums/showthread.php?s=&threadid=2776

thanks for the headsup on this one . real nasty one

 

[cloudberry]

Lately, I've discovered that there are tons of emailadresses that are spoofed somehow. I'm a nice person, so I reply to people spreading these mail viruses, and tell them that they have something going on in their computers. But with Bad trans, all the senders had invalid e-mail addresses (sorry bout the spelling problems here, I'm not a native-speaker). Last week, I recieved six to seven bad trans mails daily. Very annoying. Also, Bad trans (just as this one) has an interesting feature. Immediately when you preview or open the email, a box comes up asking you if you want to save or open the attachment. My mother (she is kind and all, but uhm, pretty stupid) had no idea what to do. So she pressed save. She only saw two options, so what was she to do?? Think about this if you lend your computer to unsuspecting relatives or friends, since some of them most likely will not see cancel as a possible option at all.... Fortunately, she did this with her own computer, not with mine.

 

[Wargasm]

b4 getting my email i check on the email server what is there
if i see emails with attachments from ppl i dunno i just delete them on the server period
then i get my email


check it out

http://www.abreuretto.com/anti-spam/