W32.Goner.A@mm is a mass-mailing worm that spreads via Microsoft Outlook and ICQ file transfers. The worm arrives with the following email message:
Subject: Hi Body: How are you ? When I saw this screen saver, I immediately thought about you I am in a harry, I promise you will love it! Attachment: GONE.SCR
Of course, the attachment is a copy of the worm, if it is opened it will send itself to addresses in the victim's Outlook address book, spread via ICQ, and delete various anti-virus and personal firewall applications.
It started spreading on the 4th December, peaking early on the 5th, HK time. By the 7th, it had all but died out. Although it was, for a short time, the commonest virus or worm, there were very few reports in Hong Kong and Asia generally. The USA and Europe were the hardest hit. The pattern of spread raises as many questions as it answers: Does it indicate that many people in Europe and the USA are regularly distributing screensavers, and, therefore, they did not see the message as suspicious? Is security awareness actually better among users in Asia? Why did the numbers drop so quickly, while other worms, such as Sircam and Badtrans, continue spreading at high levels for months?
Four high school students were arrested in Israel on the 7th December for involvement in writing and distributing W32/Goner.A@mm. They could face between three and five years in jail if convicted.