CUPERTINO, Calif. - Dec. 4, 2001- Symantec Corp. (NASDAQ: SYMC), the world leader in Internet security, warns against W32.Goner.A@mm - a mass mailing worm that spreads itself through e-mail by accessing the Microsoft Outlook address book and through the ICQ network messaging system. W32.Goner.A@mm, also attempts to delete critical files associated with anti-virus and personal firewall programs.
If mIRC, an Internet Relay Chat program, is installed on an infected computer, the worm can also insert mIRC scripts that will create a backdoor. This will enable the infected computer to be able to be used in a Denial of Service (DOS) attack.
"At this time we are not seeing the high level of infected file submissions that we received with some of the more widespread viruses such as VBS.LoveLetter and CodeRed," said Vincent Weafer, senior director of Symantec Security Response. "Customers who utilize Symantec's LiveUpdate feature to obtain the most current virus definitions are already protected from this latest threat."
The subject line reads "Hi." The text in the body of the email reads, "How are you? When I saw this screen saver, I immediately thought about you. I am in a harry, I promise you will love it!" When the attached document - Gone.scr - is executed, the worm modifies the registry, attempting to delete files of common anti-virus and personal firewall products. If the files are in use and cannot be deleted, the worm will create the file %SYSTEM%\Wininit.ini, which causes the files to be deleted when the computer restarts.
Symantec recommends customers use the LiveUpdate feature built into Symantec's Norton AntiVirus software to protect their systems. Updates are also available at the Symantec Security Response Web site: http://securityresponse.symantec.com.
Symantec, a world leader in Internet security technology, provides a broad range of content and network security solutions to individuals and enterprises. The company is a leading provider of virus protection, firewall and virtual private network, vulnerability management, intrusion detection, Internet content and e-mail filtering, remote management technologies and security services to enterprises around the world. Symantec's Norton brand of consumer security products leads the market in worldwide retail sales and industry awards. Headquartered in Cupertino, Calif., Symantec has worldwide operations in 37 countries. For more information, please visit www.symantec.com.
NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site. All prices noted are in US dollars and are valid only in the United States.
Symantec, the Symantec logo, AXENT, AXENT Technologies, and the AXENT logo are trademarks or registered trademarks, in the United States and certain other countries, of Symantec Corporation or its subsidiaries. Additional company and product names may be trademarks or registered trademarks of the individual companies and are respectfully acknowledged.