From
http://securityresponse.symantec.com/avcenter/venc/data/w32.goner.a@...

W32.Goner.A@mm is a mass-mailing worm that is written in Visual Basic. The
worm has been compressed using a known Portable Executable (PE)* file
compressor. The worm can spread its infection using the ICQ network as well
as by email using Microsoft Outlook. If IRC is installed, this worm can
also insert mIRC scripts that will enable the computer to be used in Denial
of Service (DOS) attacks.

W32.Goner.A@mm starts by displaying an "About" window with credits of the
author and shoutouts to his friends.

In the background, the worm starts iterating the Microsoft Outlook address
book and sends itself to all addresses in the address book. The email
appears as follows.

Subject: Hi
Body:
How are you ?
When I saw this screen saver, I immediately thought about you
I am in a harry, I promise you will love it!
Attachment: GONE.SCR

W32.Goner.A@mm is capable of spreading over the ICQ network. If ICQ is
installed on an infected machine, the worm will do the following:
1. Check for the version of the ICQ .dll file that contains the APIs that
will be used. If the correct version is found, the worm proceeds.
2. Disable all notification. This means that the user cannot see what the
worm is doing in the background.
3. Retrieve a list of all "buddies" who are currently online.
4. Retrieve information about each user individually. This information is
required to be able to send files.
5. Send itself to all users on the list.
6. Re-enable all notifications.

If mIRC is installed, this worm can insert scripts into the mIRC folder.
This allows the computer to be used in DOS attacks.

Finally, the worm displays the following fake error message:

"Error while Analyze DirectX!"

If you get this email DO NOT OPEN THE ATTACHMENT.

Thanks for reading,

Talies the Wanderer
EQ Bards

[Non-text portions of this message have been removed]