Magistr Makes a Grand Return as Magistr.b
Internet users are warned about the detection of the new variant of the dangerous "Magistr" virus. Anti virus developers have already received several reports regarding infection in Spain by this malicious program.
“In ‘Magistr.b,’ a substantially reworked encoding algorithm of the
virus’ code is utilized. Because of this, none of the known anti-virus
scanners are able to recognize this new virus variant even with the heuristic
code analyzer
switched on,” commented Eugene Kaspersky, Head of Anti-Virus Research
at Kaspersky Labs.
Kaspersky Labs has effectively and efficiently reacted to the appearance
of this new threat, releasing the
corresponding Kaspersky™ Anti-Virus database update containing defense
procedures thwarting “Magistr.b” at midnight on September 4.
This variant is characterized by exclusively dangerous side effects, and also noticeably reworked virus spreading procedures via the local network and e-mail.
In addition to destroying all files on the local and network disks,
corrupting data stored in the CMOS memory (the computer hardware boot-up
parameters) and FLASH BIOS microchip, “Magistr.b” overwrites the OS-loaders
WIN.COM and NTLDR in such a way that under certain conditions upon the
next computer start-up, all data on
the local and network disks are deleted. While searching for target
files to be infected, the virus also destroys files with the .NTZ extension.
Also, if "Magistr.b" detects the active copy of "ZoneAlarm" personal firewall
software running it automatically disables it.
In order to obtain e-mail addresses for the further spreading, “Magistr.b”
scans the databases of Eudora, Outlook Express, Netscape Messenger, Internet
Mail e-mail clients and the Windows address book. The virus, as an addition
to .DOC and .TXT file formats, is able to attach .GIF files as well. In
addition, a wide search is conducted for accessible network resources where
“Magistr.b” will try to plant its copies. The virus searches the following
folders: "WINNT", "WINDOWS", "WIN95", "WIN98", "WINME", "WIN2000",
"WIN2K", and "WINXP." In this way, the virus is able to more effectively
spread and noticeably improve its rate of “success” in penetrating victim
computers.
“Today, ‘Magistr’s’ first variant firmly holds a high position in
the list of the most widespread malicious code, second only to the ‘SirCam’
Internet worm. Don’t be in doubt that the latest ‘Magistr’ modification
has the potential for being as wide spread as the original. This could
lead to another global epidemic,” said Denis Zenkin, Head of Corporate
Communications for Kaspersky Labs.
As previously noted by Kaspersky Labs, 'Magistr' belongs to the category of viruses known as “sleepers.” This virus type does not reveal itself until the moment the virus’ payload activation arrives. The original 'Magistr' confirmed the Kaspersky Labs’ prediction and within a month of detection, “Magistr” placed first in virus-activity ratings.
A more detailed description of this virus is available on request
only.
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5)THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
040901/110904/061004
