Removal Tool for the W32.Goner.A@mm Virus (Gone.scr). Please read the abstract for usage information or go to http://www.sarc.com website for the full story.


What the tool does 

The W32.Goner.A@mm Removal Tool does the following:

1. Terminates all the viral W32.Goner.A@mm processes.
2. Deletes any W32.Goner.A@mm executable files.
3. Removes registry modification.

Command-line switches available with this tool
/SILENT, /S - Enables silent mode.
/LOG=<pathname> - Creates a log file where <pathname> is the location 
		  in which to store the output of the tool.
/START - Forces the tool to start scanning immediately.


To obtain and run the tool

CAUTION: Once a computer has been attacked by W32.Goner.A@mm, it is possible 
that the system security has been compromised. The worm deletes common 
antivirus and firewall products and requires that such products be reinstalled.

NOTE: You must have administrative rights to run this tool on Windows NT4.

1. Download the FixGoner.exe file from:

http://softarch.massey.ac.nz/pub/pc32/Virus/fix_goner.exe

2. Save the file to a convenient location, such as your download folder or the 
   Windows desktop (or removable media that is known to be uninfected, if possible).
3. Close all running programs before running the tool.
4. Disconnect the computer from the network.
5. If you are running Windows Me, then disable System Restore. 
6. Double-click the FixGoner.exe file to start the removal tool.
7. Click Start to begin the process, and then allow the tool to run.
8. Restart the computer.
9. Run the removal tool again to ensure that the system is clean.
10. If you are running Windows Me, then re-enable System Restore.
11. Run LiveUpdate to make sure that you are using the most current virus definitions.

NOTE: The removal procedure might be unsuccessful if Windows Me System Restore is 
      not disabled as previously directed because Windows prevents System Restore 
      from being modified by outside programs. Because of this, any worm-removal 
      attempts made by the removal tool might fail.

When the tool has finished running, you will see a message indicating whether the 
computer was infected by the W32.Goner.A@mm. In the case of a removal of the worm, 
the program displays the following results:

The total number of the scanned files.
The number of deleted files. 
The number of viral processes terminated.
The number of registry values deleted.