Goner Virus -- email virus wreaking havoc on web

www.mcafee.com ^ | December 4, 2001 | Christopher M. Hoss

[topher]

http://vil.mcafee.com/dispVirus.asp?virus_k=99272&

The above web link describes the GONER VIRUS/WORM and the potential damage.

The good news is that YOU MUST OPEN THE SCREENSAVER ATTACHMENT TO BE INFECTED.

Evidence that your PC is infected is the presence of the file GONE.SCR

The McAfee Web Server is overloaded by people trying to get into the site.

Here is a CLICKABLE link to the McAfee web site:

Goner Virus Info from McAfee (12/04/2001)

This virus has appeared on the Internet just today (Tuesday, December 4, 2001).

I can email people information about the virus, but I have it in Microsoft Doc/RTF format currently because it had pictures and graphics about what appears on the PC.

[copycat]

As far as free Anti-Virus software, you get what you pay for. I recommend BUYING one. Norton AntiVirus is a good one. It autoupdates itself too!

Not til after Christmas, friend! FReegards...

[Myrddin]

I pulled the patch, but it wants the Office 2000 CDROM to check for a valid install before it will do the patch.

My office IT staff spotted the virus quickly and fixed the McAfee virus scanner on the Exchange Server. It was an interesting game of "whack the mole" for about 15 minutes.

[Diddle E. Squat]

Thanks for taking the time to answer. That seems the most logical explanation.

[Diddle E. Squat]

So if I steam iron my e-mail, will that eliminate the virus?

[CheneyChick]

I contend that the vast majority of idiots who open attachements like this are chicks.

Have you always been a jerk, or is today extra special?

FWIW, I have received about 50-60 of these so far today, and managed not to open any of them..... Hmmm.

[Rodney King]

You think it is 50-50? In my experience, it is mostly women.

[Ditto]

...and install the horrible Outlook on their laptops.

I have only seen Outlook a few times, but it seems that preview box opens attachments without you asking. Just scanning through the inbox is all it takes to open a nasty. Is that correct?

I normally use exchange and you have to double click on attachments to open them. BTW. I bet I have gotten 50 of those 'gone' e-mails today. My name is near the top of a large, multi-national address box and as the day has gone on this virus is literally spreading all over the world judging by the addresses of the senders.

[TankerKC]

Just curious, how do the "idiot" users rate their IT support?

Good question. I got hit with an old virus (first found in April) last week because an IT guy turned of my virus protection (which is all managed thru the LAN cuz there at too many idiot users </sarcasm> ). Then, the IT guy didn’t know how to reload the signature files off of the LAN. He also had no idea how to clean my computer. I went to the McAfee website and read how to manually clean my machine. Thanks IT!

[Diddle E. Squat]

"Hi Fred, I'm off to crash the server, wish me luck!"

[TankerKC]

Or would you hire a person who can't drive to be a driver?

Somewhat of a bad analogy. You might hire a driver who couldn't rebuild an engine.

[Ben Chad]

Does Microsoft own stock in the anti-virus companies? In other words, why doesn't MS fix its sh*t and eliminate product features that harbor these viruses? Sheesh.

[gogov]

I've just spent two hours cleaning it up. I have too many idiot users who can't remember not to open strange attachments.

Not just strange attachmnents. Don't open any attachements.

And if you have a business, don't let everyone in the office hook their computers - and your network - to the internet.

Set up seperate computers as internet and email stations, which will solve two problems. First, it will keep internet viruses out of you network. Second, it greatly reduces the amount of time employees spend playing on the internet. They are a lot more aware of time they are spending when at a shared station.

Put the shared station out in the open, not in a seperate room or office.

[oc-flyfish]

A decent IT department would have dealt with this at the mail server level than pray that non-computer experts would be able to deal with the problem. I would be embarassed to publically admit that a virus/worm had made it past my defenses into a user's mailbox.

Yes, you are right. We in IT need to assume that users will click on ANYTHING that drops in their mailbox. My mailserver is blocking based on extension and already caught this virus 6 times today. If I hadn't been blocking... well... let's just say I wouldn't have time to be posting this message right now.

[oc-flyfish]

I haven't read through all the posts yet so I apologize if this has already been posted.

Here are instructions on how to remove this virus.

[oc-flyfish]

And any tech worth his name knows for a fact that a brand new virus can't be scanned for on the server since the scanner doesn't have it in it's virus def files yet. It's ultimately up to your users not to be hair brained idiots

True, but most server-based antivirus solutions can also block based on extension. I use Symantec Norton Anti Virus for Exchange. Check it out.

[oc-flyfish]

I cannot imagine that an employee who opens virus-laden attachments is a profitable employee.

Wrong on that count. Most salespeople are computer illiterate yet they make tones of cash for the company. At least this is the case in my experience (11 years).

[Criminal Number 18F]

A good IT department tries to prevent problems before they have to solve them.

A good IT department wouldn't have allowed the installation of Outlook or Exchange -- the way 99.999% of these things spread.

Truth be told, the IT people are often overruled by management.

When Microsoft named a hollow marketing suit with no security experience, Scott Culp, head of security, that should have been a clue. Culp has since made quite a career at trying to shift blame from Outlook to various innocents.

People who don't run Outlook, Outlook Express, or Exchange, don't have these problems.

d.o.l.

Criminal Number 18F

[motzman]

blessed be the user, for the user does provide our paychecks.

Well, at least you get it. I was about to blast you and others over the "everyone's an idiot" nonsense, because I just had a nice little experience with the virus today.

My boss, who happens to be my best friend, and I were going over some loans today when his new laptop kept on getting the old "new mail" chime. He says to me that the IT guy just called him and told him not to open any of these for the obvious reasons. I was starting to show him how to delete them all at once (I know a bit more than he does about computers) when he accidentally double clicked the message, but did not open the attachment.

He was about to yell the "F" word out, when I told not to worry, etc, etc.

Anyway, the point of the story is that he's 34 (so am I) and has been very busy over the last few years creating a company that employs about a dozen people, is very profitable, and does a lot of good for the community. I'm very happy he wasn't wasting his time learning about computers as his talents are creating businesses and generating profits which employs the Nerds who cannot even compose a full sentence, or iron a shirt, or have a social interaction with a live being (not YOU, but I'm sure you know more than a couple of 'em).

I've worked at quite a few companies that employed a cadre of Nerds, some who could actually speak English, and even one or two that wasn't a complete social embarrasment. When the Nerds would give you the "your an idiot" look, I always would invite to go out to the bar and pick up some women. That would shut them up fast, because deep down inside they knew that they were Nerds, and completely unable to interact with a real live woman.

God Bless those who risk it all to provide jobs for others....and bless the salesmen too!

[oc-flyfish]

People who don't run Outlook, Outlook Express, or Exchange, don't have these problems.

You are wrong. It also spreads via ICQ and mIRC as well.

It's just as easy to write a virus for the other email programs out there. The main reason we see them written for Outlook/Outlook Express is because of the huge installed user base. No email client is completly immuned to viruses.