New e-mail virus cripples Internet firewall software

Advertiser Staff and News Services

A fast-spreading computer virus masquerading as a screen saver ripped across the Internet yesterday, clogging both corporate and home e-mail while stripping computers of their protection against hackers and viruses.

The virus — nicknamed "Pentagone," "Gone" or "Goner" by anti-virus firms — deletes commercial anti-virus and firewall software.

It tries to spread itself through ICQ instant messaging. Mainly, though, the worm spreads in e-mails sent via the Microsoft Outlook or Outlook Express e-mail programs.

The subject line of infected messages says "Hi." The message body begins: "How are you? When I saw this screen saver, I immediately thought about you."

The virus — technically called a worm because it can propagate itself — is unleashed when the recipient double-clicks or opens an attachment called "gone.scr."

The .scr on the file name normally identifies screen saver programs, but can be used to disguise computer worms or viruses.

Once unleashed, the worm e-mails itself to addresses it finds in Outlook or Outlook Express.

Corporate and home computer users alike were hit hard by the Goner worm yesterday.

Computers used at about 125 companies in the United States and Europe were infected with the virus, said Kaori Iizumi, spokeswoman at Trend Micro Corp., the fourth-largest anti-virus software maker.

MessageLabs, a British e-mail screening firm that specializes in e-mail security, intercepted 33,000 copies of the virus by 1:35 p.m. yesterday at a rate of 130 a minute, making it one of the fastest-spreading viruses it has ever seen, reported David White, the company's technical manager at its U.S. branch office in Bloomington, Minn.

The virus also spread to Asia early today, with South Korea's largest anti-virus software firm, Ahnlab Inc., reporting it had been notified of 10 incidents.

The virus spread at investment banks and money managers such as New York-based Amerindo Investment Advisors Inc. An employee downloaded the attachment, unwittingly sending the virus to all names in his address book.

"When he opened it, it reproduced itself and was sent around the firm, and then I opened it, because I knew who it came from, and then it sent it out to my entire contact list," said Richard Dukas, a spokesman with Amerindo.

The virus also hit some computer users and organizations in Hawai'i, although the extent seemed to be relatively limited.

Peter Kay, chief executive of CyberCom, a Hawai'i company that develops business Web software, said none of his clients in Hawai'i had reported being affected yesterday, but said the virus' rapid spread shows that people need to relearn safe computing habits.

"You have to have anti-virus software installed on your computer. That's the bottom line," Kay said. "I'm having a hard time trying to understand why anyone would not have anti-virus software. It's kind of like electricity: If you're plugging into your computer you've got to have anti-virus software."

Computer users should download the latest version of their favorite anti-virus software, experts recommended. Macintosh users are not believed to be susceptible.