Updated on 04 Dec 2001 by Nieusma

w32.goner.A Virus Info

Symantec info about this virus.

It is an e-mail with Hi as the subject and Gone.scr as the attachment. You must run the attachment to infect yourself.

The worm propagates by sending to everyone in your address book. It writes to the registry and saves itself in %SYSTEM%/gone.scr. At startup time it tries to delete antivirus definition files.

To fix it

delete %SYSTEM%\gone.scr if it exists
associate .SCR files to notepad by running assoc .scr=txtfile in a cmd or dos window, or just run fixgoner.bat

Delete the registry key [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\%WINDIR%\SYSTEM\gone.scr=C:\%WINDIR%\SYSTEM\gone.scr] or just run fixgoner.reg