appConfigEntityId

bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

hooksAmpRedirectArticle

articleSchemaContent

hooksArticlePageAdvertisementConfigArticle

liveArticle

appConfig

advertZone

sentiment

contentLock

topics

types

sections

paywallTypes

createdDate

publishedDate

sponsorType

urlAlias

moreOnThisArticles

sectionsV2

commentCount

authorLocations

authors

corrections

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

articleSpeeches

socialHeadline

headline

images

flag

firstTopic

glossary

flattenTypeIds

image

relatedLinks

relatedNewsletters

__typename

sponsor

pdfFiles

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

readingTime

customTimezone

liveContents

json

SCMP Reporter

Hong Kong and the rest of Asia escaped relatively unscathed on Wednesday as a new, mass-mailing virus swiftly infected tens of thousands of computers across the United States and Europe.

But anti-virus software experts said the computer worm Goner, officially known as W32/Goner@MM, could spread quickly through corporate and personal e-mail in-boxes, deleting system files and clogging networks in what could be the biggest outbreak since last year's Love Bug.

The Hong Kong Computer Emergency Response Team (Cert) co-ordination centre received only one report of Goner infection on Wednesday afternoon, but advised companies and individual Internet users to update anti-virus systems as a precaution.

Cert spokesman Roy Ko said the centre would remain on stand-by alert last night 'because the worm can spread through ICQ desktop messaging, and we expect most Hong Kong people with ICQ accounts to chat only after office hours or after school'.

The fast-spreading Goner worm propagates through e-mail, with the subject line 'Hi' and carries an infected attachment called GONE.SCR, which masquerades as a Microsoft Windows screen saver. 

Among the first to be infected by the malicious message were users of ICQ and IRC (Internet relay chat) messaging systems. 

The Goner message states: 'How are you? When I saw this screen saver, I immediately thought about you I am in a harry [sic], I promise you will love it!'

Infection occurs soon after the recipient double-clicks on the file, mass-mailing itself to everyone in the user's Microsoft Outlook and Outlook Express address books.

When executed, the worm displays a message box entitled 'About', and after a short time, another window entitled 'Error' is displayed. 

It also attempts to disable anti-virus products from the infected computer by deleting files from the installation directory. 

According to anti-virus vendor Symantec, Goner also tries to install a denial-of-service script on machines of IRC users. That can turn PCs into launch pads for denial-of-service attacks, which fill affected Web servers with so much traffic it blocks all other data transmission.

Goner took the spotlight on Wednesday at the close of the Avar (Association of Anti-Virus Asia Researchers) conference in Hong Kong. Computer security specialists said the Goner virus would be around for some time.

Officials from anti-virus software vendors Symantec, Trend Micro, McAfee, Sophos and Computer Associates, said they were up all night to monitor Goner's fast rate of infection in the US and Europe. 

Trend Micro recorded infections in 17,000 computer workstations and 30,000 corporate e-mail accounts across Europe. British security outsourcing company Messages, a partner of McAfee, said it was receiving more than 100 copies of the worm a minute, totalling about 23,000 worldwide since early Tuesday morning in Britain, with users in 17 countries hit.

McAfee received reports of 10,000 machines on two corporate sites in the US being infected by Goner.

David Banes, Symantec's regional manager for security response in Asia-Pacific, said there were a few hundred corporate and individual sites in North America that Symantec knew were infected, but just a handful of sites in Asia on Wednesday.

Tokyo-based Trend Micro said there were no major incidents reported in Japan. South Korea's Information Ministry reported 20 cases, but said Goner would not significantly affect computer networks because ICQ was not widely used.

Sophos chief executive Jan Hruska said the virus was so simple and had an innocuous message it was effective at spreading infection quickly, just like the Love Bug.

By pretending to be an e-mailed love letter, Love Bug played on a user's curiosity and spread worldwide in hours last May. He said the virus would be around for some time because home PC users were not as vigilant in following security precautions and updating anti-virus software as enterprises.

Abby Tang, North Asia regional engineering manager at Network Associates, maker of McAfee anti-virus products, said: 'Goner is clearly a serious threat and one that companies in Asia cannot afford to be complacent about. Our support centre in Hong Kong has been receiving an increasing number of reports from customers across the region.'
Vincent Gullotto, senior director of research at McAfee's anti-virus emergency response team, said Asian companies might be more mindful now about being alert to e-mail from unknown senders, but precautions should be strict at all levels of a company, including those who accessed corporate networks from outside.




Worm can make PCs a goner