Say bye to "Hi how are you" worm

BANGALORE: A new worm spreading rapidly across the globe through Microsoft

Outlook and Internet messenger program, Worm_Gone.A (alias Gone.scr), is

currently classified as high risk. The worm, disguised as a Screen Saver;

attempts to delete anti-virus programs.

This virus is capable of spreading through Microsoft Outlook and the ICQ (I

Seek You) messenger program. When spreading through email, the attachment is

named "GONE.SCR," with the "Hi Message: How are you?"

subject along with the message "When I saw this screen saver, I immediately

thought about you I am in a harry, I promise you will love it!"

The worm, when run, mass-mails itself to everyone in the user's Microsoft

Windows Address Book. When executed, it displays a message box entitled

"About,'' and after a short time, another window entitled "Error"

is displayed. The worm also attempts to delete the following files, some of

which are from anti-virus software programs.

A media statement from Trend Micro stated, "An updated virus pattern,

file nos. 177 and 977 (depending upon the scan engine being used) can be used to

detect and remove this worm, Worm_Gone.A. This pattern file is available for

download from Trend Micro's Web site at www.antivirus.com.

Trend Micro also advises customers to use their InterScan and ScanMail eManager

content filtering plug-in to block the attachment, ‘GONE.SCR.’ Desktop users

can take advantage of Trend Micro's free online virus scanner, Housecall, to

scan their system for this virus."

On the other hand, McAfee quoted, "An immediate information and cure for

this virus can be found online at the McAfee AVERT site at http://vil.nai.com/vil/virusSummary.asp

Virus k=99272. McAfee VirusScan users should update their systems from that page

and use the 4.0.70 or later scanning engine to stop potential damage."

"This is a rapidly spreading worm that appears to be making the

rounds," said Joe Hartmann, director of North American antivirus research

for Trend Micro. "We have had several reports of the virus in the US and

Europe. However, the number of actual infections and the extent of damage from

this virus are yet to be determined.