Oslo, 4 December 2001   

Norman ASA, a world leader in the field of data security today warns against a new fast spreading e-mail worm with the name W32/Goner.A@mm

This is an e-mail worm that spreads through e-mail and the chat program IRC. (Update 5 December: W32/Goner A spreads through e-mail and the chat program ICQ.)

  • The subject of the e-mail is: Hi,
  • The bodytext is: How are you ? When I saw this screen saver, I immediately thought about you I am in a harry, I promise you will love it!
  • The attachement is: GONE.SCR
  • Spreading mechanism: When executed, it will first display a small animated picture, which will be immediately followed by an error message. After this it will mail itself to all addresses in the Outlook address book. The worm copies itself to the Windows system directory under the name GONE.SCR and sets the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run to point to this
  • Destructivity: The worm is not yet fully analysed

Norman Virus Control with definitions files from December 4th 2001 or later detects this worm. Users are encouraged to update their Norman Virus Control protection to the most recent version.For updates of this information visit: www.norman.com

(5 December: Updated information in the virus description)

For further information, please contact

Norman ASA, VP Marketing Bjørn A. Windfeldt, tel.+47 67 10 97 76, mob. +47 41 53 97 76