Israeli Teens Arrested for 'Goner' Worm

Four Israeli secondary-school students have admitted to creating the "Goner" e-mail worm, which started spreading rapidly last week.

The youths, aged 15 and 16, were arrested Friday in the northern city of Nahariya, according to Israeli and foreign press reports.

They created the worm as part of a competition with a rival group of hackers, the reports said. If convicted, the youths could face three years to five years in prison.

Hundreds of thousands of computers around the world received the Goner worm as an e-mail attachment disguised as a screen saver. But researchers have said the economic damage caused by the attack is relatively small, partly because antivirus software vendors reacted quickly with virus-definition updates.

Fake Screen Saver

Goner appears in user's in-boxes as an e-mail with the subject line "Hi." The body of the message reads, "How are you? When I saw this screen saver, I immediately thought about you ... I am in a harry [sic], I promise you will love it!" The e-mail also includes an attachment called Gone.SCR, which appears to be a screen saver.

If opened, Goner attempts to send itself to all addresses in the address book of Microsoft Outlook and Outlook Express mail programs. It tries to delete security software and can spread via instant messaging programs ICQ and Internet Relay Chat.

The worm installs a backdoor program that is activated whenever the mIRC chat application is launched and that can be used in Denial of Service attacks, Trend Micro said. After double-clicking on the attachment, a window also pops up, which includes credits for the virus' writer and its testers.

After launch, Goner attempts to locate and delete a number of programs, including security programs like Zone Labs' ZoneAlarm firewall application, McAfee.com's Goostree said. Other files it attempts to delete include antivirus programs from Symantec and Kasperksy Labs, and security applications from Lockdown, and SafeWeb, according to both McAfee.com and Trend Micro.

Damage Minimized

The research firm Computer Economics estimated damages by Goner at $5 million worldwide, attributing most to cleanup costs for organizations that did not have updated antivirus software. Only 10 percent of the amount is for loss in productivity, the research firm estimates. The researchers estimate that about 800,000 computers worldwide received the Goner worm.

Goner is small potatoes compared with the Love Bug or Love Letter worm, the mother of all mass-mailer worms that hit the Internet early last year and cost businesses an estimated $8.75 billion, according to Computer Economics.

Users are advised to update their virus definitions, visit the Web site of their antivirus provider, and not open unexpected attachments.

Sam Costello and Joris Evers of the IDG News Service contributed to this report.