WORM_GONER.A

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It gathers target email addresses from the Windows Address Book (WAB).

It joins an Internet Relay Chat (IRC) channel. It executes commands from a remote malicious user, effectively compromising the affected system. It may also connect to Internet Relay Chat (IRC) servers and receive commands from a remote user.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
%System%\gone.scr = %System%\gone.scr

Propagation

This Trojan gathers target email addresses from the Windows Address Book (WAB).

It sends copies of itself to target recipients using the following instant-messaging (IM) applications:

• ICQ

Backdoor Routine

This Trojan joins any of the following Internet Relay Chat (IRC) channels:

• #pentagonex

It executes the following commands from a remote malicious user:

• DDos
• Flood Channel
• Send private message
• Send copies of itself

It may also connect to Internet Relay Chat (IRC) servers and receive commands from a remote user.

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• Aplica32.exe
• Avconsol.exe
• Avp.exe
• Avp32.exe
• Avpcc.exe
• Avpm.exe
• Cfiadmin.exe
• Cfiaudit.exe
• Cfinet32.exe
• Esafe.exe
• Frw.exe
• Icload95.exe
• Icloadnt.exe
• Icmon.exe
• Icsupp95.exe
• Icsuppnt.exe
• Lockdown2000.exe
• Navapw32.exe
• Navw32.exe
• Pcfwallicon.exe
• Safeweb.exe
• Tds2-98.exe
• Tds2-Nt.exe
• Vsecomr.exe
• Vshwin32.exe
• Vsstat.exe
• Webscanx.exe
• Zonealarm.exe
• _Avp32.exe
• _Avpcc.exe
• _Avpm.exe