1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

New Virus alert GONE.SCR

Discussion in 'Virus & Other Malware Removal' started by Ginnis12, Dec 4, 2001.

Thread Status:
Not open for further replies.
  1. Ginnis12

    Ginnis12 Thread Starter

    Nov 30, 2001
    I just heard it on the news.

    A mass-mailing e-mail worm started to spread quickly Tuesday, prompting antivirus software makers to advise their customers to upgrade their virus definitions.
    Dubbed Pentagone, Goner or Gone, the Visual Basic Script program spreads via e-mail and the messaging system ICQ. On infected computers, it stops most antivirus and security programs.
    The worm only affects computers running Microsoft Windows and spreads through Outlook e-mail clients. Macs and computers running Linux or other Unix-like operating systems are unaffected.

    The worm arrives in a message with the subject "Hi" and the following text in the body of the e-mail:

    How are you ?
    When I saw this screensaver, I immediately thought about you
    I am in a harry, I promise you will love it!

    Attached to the message is what appears to be a screensaver file, Gone.scr, a compressed copy of the worm.

    When the file is opened, Pentagone will infect the victim's PC, stopping a variety of antivirus and security applications and deleting all the files in the folders containing those applications. Kaspersky Lab's AVP, Zone Labs' ZoneAlarm, and Internet Security Systems' Black Ice are among the programs affected.

    After eliminating the security on the computer, the worm opens up a dialog box containing its name, Pentagone, and the handles of its creators. The dialog box also includes acknowledgements to other people on the Net, in a style similar to that of online vandals who deface Web sites.

    The worm then installs a backdoor program linked to mIRC, a popular Internet Relay Chat program. The backdoor can be used to execute denial-of-service attacks against IRC servers.

    In addition, the virus attempts to spread using e-mail and ICQ.

    To spread by e-mail, Pentagone uses script commands to send a copy of itself to every entry in the victim's Outlook address book. In ICQ, the worm uses specific commands to send a copy of itself to other people using the messaging application.

    Antivirus software makers have been inundated with calls from customers who have been infected or seen copies of the worm.

    Just thought I'd throw that out for y'all :p
  2. $teve


    Oct 9, 2001
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/60747

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice