Going, Going, Goner - Page 2

By Jim Freund | Posted Dec 5, 2001
Page 2 of 3   |  Back to Page 1
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

Payload
Fake error from GonerWhen the file attachment is executed, the malicious program displays what appears to be a splash screen for a supposedly legitimate screensaver, and then an error message, in an attempt to lull the user into thinking that the screensaver simply didn't work. Of course, there's other dirty work afoot. The program copies itself to either C:\WINNT\SYSTEM32\ or C:\WINDOWS\SYSTEM32 (depending on the OS) as SCR.EXE. As with several other recent viruses, such as the recent BadTrans.B, Goner adds an entry to the Windows registry as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ C:%WINDIR%\SYSTEM\gone.scr=C:\%WINDIR\SYSTEM\gone.scr
This causes the program to load again upon the computer's reboot, thereby perpetuating its existence on the machine. So far this has all been about propagation. What makes Goner insidious is its ability to look for and terminate several anti-virus and security programs or processes. These include:
  • _AVP32.EXE
  • _AVPCC.EXE
  • _AVPM.EXE
  • APLICA32.EXE
  • AVCONSOL.EXE
  • AVP.EXE
  • AVP32.EXE
  • AVPCC.EXE
  • AVPM.EXE
  • CFIADMIN.EXE
  • CFIAUDIT.EXE
  • CFINET.EXE
  • ESAFE.EXE
  • FEWEB.EXE
  • FRW.EXE
  • ICLOAD95.EXE
  • ICLOADNT.EXE
  • ICMON.EXE
  • ICSUPP95.EXE
  • ICSUPPNT.EXE
  • LOCKDOWN2000.EXE
  • PCFWallIcon.EXE
  • PW32.EXE
  • SAFEWEB.EXE
  • TDS2-98.EXE
  • TDS2-NT.EXE
  • VP32.EXE
  • VPCC.EXE
  • VPM.EXE
  • VSECOMR.EXE
  • VSHWIN32.EXE
  • VSSTAT.EXE
  • VW32.EXE
  • WEBSCANX.EXE
  • ZONEALARM.EXE

If one of these processes is present, it is terminated, and all files in the directory tree where the executable is located are erased. Failing that, Goner may create a WININIT.INI file to try the task again upon a Windows restart.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter