posted 12-06-2001 12:13 AM         

Hi Larry,

I'm forwarding a cautionary advisory about yet another "worm" virus that's in circulation. Be selective when opening attachments, no matter how attractive they may seem to be. I do not open attachments unless I'm very sure what's inside.

Accordingly, don't forward jokes and "stuff" to me as attachments because I'm never sure whether it's "you" sending me something, or maybe a in your machine "worm" sending me an attachment in your name. To be safe, I delete it and do without the attachment.

Good luck. I hope this has not already hit your computer.

Ed Hunter
Greetings,
Please forgive me if you've already received this alert, but here is yet another threat.

I forward the following explanation and "fix" if you've already been victimized.

Good luck and best regards,
Ed Hunter

--------------------------------------------------------------------------------

----- Original Message -----
From: Daniel Hooper

Hi, friends. This is a legitimate warning about yet another computer virus that emerged this morning. It has hit my office in Los Angeles this morning (four different users within an hour) but I haven't been hit myself. Symantec, which produces Norton Antivirus software, is still trying to roll out an anti-virus fix for it.

The new virus or "worm" actually is being sent via Microsoft Outlook email. It has a "GONE.SCR" as an attachment. Please delete any e-mails containing "gone.scr" as an attachment. If you use Outlook and have received the e-mail, chances are very good that your machine has also forwarded the virus to all your friends and colleagues in your personal address book!

What happens? This virus will delete a significant number of files from your hard drive and/or create an "INI" file to run itself after you re-boot. THINGS TO LOOK FOR IF YOU THINK YOU MAY HAVE RECEIVED THE VIRUS:

1. If you receive a message apparently from someone you know, with the subject line reading "Hi" and the body text of "How are you ? When I saw this screen saver, I immediately thought about you I am in a harry, I promise you will love it!" (Yes, "hurry" is misspelled.) The attached file is called GONE.SCR and it's size is 38Kb. >> Delete the incoming message. If you recognize the name of the person sending it, you might want to write back (not reply) and tell him/her that you received an infected message.

2. In the C:\windows\temp or C:\temp directory, the file will be called "GONE.SCR" >> Delete this file.

3. In the C:\WINDOWS directory, there will be a file called WININIT.INI with today's date and time. >> Delete this file also.

4. If you feel competent to check your Windows Registry file, this worm (virus) adds the value

C:\%SYSTEM%\gone.scr C:\%SYSTEM%\gone.scr

to the registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
If you drill down to this level and see the key on the right side of your screen, delete the key, and close out the registry. If you have never edited your registry before, be careful, and take the precaution of running a back-up on it before you change it.

Full information is available at www.symantec.com. Good luck!