I see worms come and go as I work on my system, because my system, like many others is connected to the Internet. But I usually don't see them come at me as quickly as they did Tuesday afternoon.

While conducting a training session at a client's facility, I saw 18 malicious emails in just a few minutes. It was the Goner worm, a new, fast spreading worm that breaks down your defenses to other cyber-predators.

The worm reaches you by email like so many other worms, disguised to make itself look like it is being sent by a friend. Then, when you open the attachment to invoke the malicious code, it attacks your anti-virus software and firewall. Specifically, it tries to delete a number of files that are typically associated with anti-virus software and firewall software. If it can't find the files, it goes to sleep until you reboot your system. And then it tries again to attack those files. Presumably, if you install new anti-virus software after the attack, Goner will wake up the next time you start up the system and remove your new anti-virus capability.

What to look for:

Subject:

Hi

Body:

How are you? When I saw this screen saver, I immediately thought about you.

Attachment:

Gone.scr

• aplica32.exe
• zonealarm.exe
• esafe.exe
• cfiadmin.exe
• cfiaudit.exe
• cfinet32.exe
• pcfwallicon.exe
• frw.exe
• vshwin32.exe
• vsecomr.exe
• webscanx.exe
• avconsol.exe
• vsstat.exe
• pw32.exe
• vw32.exe
• vp32.exe
• vpcc.exe
• vpm.exe
• avp32.exe
• avpcc.exe
• avpm.exe
• avp.exe
• lockdown2000.exe
• icload95.exe
• icmon.exe
• icsupp95.exe
• icloadnt.exe
• icsuppnt.exe
• tds2-98.exe
• tds2-nt.exe
• safeweb.exe

How not to be infected:

DON'T OPEN THE ATTACHMENT! (There, I've said it again. Aren't you tired of hearing me say this.)

Links directly to Goner at several Anti-Virus Vendors

• Symantec
• McAfee
• Trend Micro

Don't forget to get your FREE virus alerts as part of your FREE subscription to The Radin Report & TipLetter. Subscribe here.