'Goner' worm races through Asia

By CNN's Kristie Lu Stout

HONG KONG, China (CNN) -- The rapidly spreading new email worm "Goner" is running through Windows desktops across Asia.

Antivirus firms on Wednesday warned PC users across the region of W32.Goner.A@mm, a mass-mailing worm capable of deleting critical computer programs.

"It started the beginning of the day in the U.S., but it's definitely growing here in the Asia-Pacific region," said Abby Tang, a Hong Kong-based security expert at Network Associates.

"We've already received 500 calls from people concerned about the worm."

Anti-virus software firms Symantec, Network Associates and Trend Micro have issued Goner warnings to companies throughout Asia, but it is still unclear exactly how many PCs have been affected by the worm.

Worm of distinction

Goner appears as a message with the seemingly innocuous subject line, "Hi."

The body of the message reads, "How are you? When I saw this screen saver, I immediately thought about you. I am in a harry (sic), I promise you will love it!"

The worm also arrives with the attachment Gone.scr. When the attachment is executed, Goner attempts to delete all executable files in the user's Windows directory including files associated with anti-virus programs.

Two distinctive features mark the worm as a new breed of Internet threat.

Like its viral predecessors, it spreads through Microsoft's Outlook address book, but Goner also sends itself through the popular online chat program ICQ.

Another unique trait is its file size. Goner weighs in at a remarkably small 159 kilobytes.

If infected with the worm, PC users are advised to reinstall their application and anti-virus software.

'High risk'

Trend Micro issued a "High Risk" warning on Goner, based on its high level of infectiousness and level of damage it can potentially inflict.

But analysts say it may not carry the same bite of other Net infections like Sircam and Nimda.

"Looking at the technical side, Goner will not make as big an impact as Nimda," said Tang.

"Nimda spreads by email and Web servers. Goner spreads only by email and ICQ."

Nimda and Sircam made up almost half of all virus attacks in 2001, according to software security firm Sophos.

Analysts warn that the creation and spread of new worms and viruses will continue to flourish next year as more and more individuals jack into an always-on, high-speed Internet.

Network infections are also getting increasingly easy to code due to the number of tool kits freely available on the Internet. That makes it possible for even amateur coders to spawn the next major worm.