Tuesday December 4 12:58 PM ET
'Goner' Virus Infects Businesses
By D. IAN HOPPER, AP Technology Writer

WASHINGTON (AP) - Anti-virus companies scrambled to protect their customers
against a new viruslike e-mail attack Tuesday that purports to be a computer
screen saver program.

Security company McAfee reported thousands of its clients sent in copies of
the worm, called 'Goner.' An Internet worm has the ability to spread to
other computers on its own.

``It's very harmless looking,'' McAfee virus research manager April Goostree
said. The e-mail has a subject line of ``Hi,'' and asks the user to check a
screen saver program, which is attached.

If the recipient runs the screen saver, the computer becomes infected. Like
many e-mail attacks, it sends itself out to everyone in the victim's address
book. It can also sends itself through the instant messaging program ICQ.

In addition to ICQ, Goner affects only Microsoft's Outlook and Outlook
Express e-mail programs on computers running Windows.

Computer experts advise that people not open unexpected e-mail attachments,
even if the sender is someone familiar. Computer users should update their
antivirus software at least weekly.

Goner also attempts to delete critical files for any security or anti-virus
program the victim might have installed.

McAfee has placed Goner on ``outbreak'' status. The last virus with that
status was the ``Love Letter'' attack, which caused billions of dollars in
damages worldwide.

``It's moving extremely quickly,'' Goostree said. ``We're getting hundreds
and hundreds of samples in a very short time.''

Anti-virus companies received the first samples of Goner from Europe,
particularly France and Germany. Ian Hameroff, a business manager at
Computer Associates, said about 30 of its clients worldwide reported getting
the worm.

By Tuesday afternoon, several major anti-virus companies including McAfee
and Symantec had released updates so their software can detect Goner.

-

On the Net:

Symantec: http://www.sarc.com/avcenter/venc/data/w32.goner.amm.html

McAfee: http://vil.mcafee.com/dispVirus.asp?virus-k=99272&