Situation:
You heard that there are new email based virus threats that go by the following names:

W32.Goner.A@mm
W32.Badtrans.B@mm
W32.Aliz.Worm

You wonder if there is any hazard of these worms/viruses infecting your Macintosh.

Solution:
These are Windows-specific worms/viruses and cannot infect or harm a Macintosh. Since a worm/virus can be email based, a Macintosh user could pass the worm/virus on through an infected email, by forwarding it to a Windows user. If you receive an email infected with, or carrying the worm/virus, then delete the email and do not forward or reply to it. A good rule of thumb is to delete any email that has an attachment ending in .exe. There are other types of attachments that can be viruses or worms, but any time you see an attachment ending in .exe, it is an executable file for use on a Windows computer. You have no use for such a file on your Macintosh computer. For more specific information about these viruses/worms, see below.

W32.Goner.A@mm is a mass-mailing worm that is written in Visual Basic. The worm has been compressed, using a known Portable Executable (PE)* file compressor. The worm can spread its infection using the ICQ network, as well as by email using Microsoft Outlook. If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks.

The subject of the email that delivers this virus is Hi, and the name of the attachment is Gone.scr. If you receive an email with this subject and an attachment with the name Gone.scr, then delete the email and do not forward or reply to it.
 
For more information, point your browser to the Symantec Security Response W32.Goner.A@mm document.

W32.Badtrans.B@mm is a MAPI worm that emails itself out as one of several different file names. This worm also creates a DLL in \Windows\System directory as Kdll.dll. It uses functions from this DLL to log keystrokes.

This virus/worm does not always have the same subject, or attachment name. The attachment will have two extensions, meaning the attachment will have a file name that ends with one of the following extensions:

.doc
.mp3
.zip

Then one of the following second extensions:

.pif
.scr

Two examples of what an attachment would be named are:

Card.doc.pif
NEWS_DOC.mp3.scr

There are many different names that can be used. If you get an email with an attachment similar to this, delete the email. There is more specific information about this worm and what the attachments may be in the Badtrans virus write-up.

For more information, point your browser to the Symantec Security Response W32.Badtrans.B@mm document.

W32.Aliz.Worm is a very simple SMTP mass mailer worm. The worm currently only replicates on Win9X machines. The worm propagates by obtaining email addresses from the Windows Address Book and sending itself to those addresses.

This virus/worm does not always have the same subject. The attachment will be whatever.exe. If you receive an email with an attachment with this name, delete the email and do not forward or reply to it.

For more information, point your browser to the Symantec Security Response W32.Aliz.Worm document.

References:
For more general information about mass-mailing viruses or worms, read the document Are Macintoshes affected by mass-mailing viruses or worms?

Document ID: 2001120413552711
Last Modified: 09/02/2003
Date Created: 12/04/2001
Operating System(s): Mac - System 7.5, Mac - System 7.5.2, Mac - System 7.5.3, Mac - System 7.5.5, Mac - System 7.6, Mac - System 7.6.1, Mac - OS 8.0, Mac - OS 8.1, Mac - OS 8.5, Mac - OS 8.6, Mac - OS 9, Mac - OS 9.0.4, Mac - OS 9.1, Mac - OS 9.2, Mac - OS 9.2.1, Mac - OS X, Mac - OS 10.0.1, Mac OS 10.0.4, Mac OS 10.1
Product(s): Norton AntiVirus 5.0 - Mac, Norton AntiVirus 6.0 - Mac, Norton AntiVirus 7.0 - Mac, Norton AntiVirus 8.0 - Mac