Going, Going, Goner - Page 2
Payload
When the file attachment is executed, the malicious program displays what appears to be a splash screen for a supposedly legitimate screensaver, and then an error message, in an attempt to lull the user into thinking that the screensaver simply didn't work. Of course, there's other dirty work afoot. The program copies itself to either C:\WINNT\SYSTEM32\ or C:\WINDOWS\SYSTEM32 (depending on the OS) as SCR.EXE. As with several other recent viruses, such as the recent BadTrans.B, Goner adds an entry to the Windows registry as follows:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ C:%WINDIR%\SYSTEM\gone.scr=C:\%WINDIR\SYSTEM\gone.scrThis causes the program to load again upon the computer's reboot, thereby perpetuating its existence on the machine. So far this has all been about propagation. What makes Goner insidious is its ability to look for and terminate several anti-virus and security programs or processes. These include:
- _AVP32.EXE
- _AVPCC.EXE
- _AVPM.EXE
- APLICA32.EXE
- AVCONSOL.EXE
- AVP.EXE
- AVP32.EXE
- AVPCC.EXE
- AVPM.EXE
- CFIADMIN.EXE
- CFIAUDIT.EXE
- CFINET.EXE
- ESAFE.EXE
- FEWEB.EXE
- FRW.EXE
- ICLOAD95.EXE
- ICLOADNT.EXE
- ICMON.EXE
- ICSUPP95.EXE
- ICSUPPNT.EXE
- LOCKDOWN2000.EXE
- PCFWallIcon.EXE
- PW32.EXE
- SAFEWEB.EXE
- TDS2-98.EXE
- TDS2-NT.EXE
- VP32.EXE
- VPCC.EXE
- VPM.EXE
- VSECOMR.EXE
- VSHWIN32.EXE
- VSSTAT.EXE
- VW32.EXE
- WEBSCANX.EXE
- ZONEALARM.EXE
If one of these processes is present, it is terminated, and all files in the directory tree where the executable is located are erased. Failing that, Goner may create a WININIT.INI file to try the task again upon a Windows restart.
