W32.Magistr.24876@mm VIRUS

Due to the increased number of submissions, SARC has updated the threat level of this virus from 3 to 4.

W32.Magistr.24876@mm is a virus that has email worm capability. It is also network aware. It infects Windows Portable Executable (PE) files, with the exception of .dll system files, and sends email messages to addresses that it gathers from the Outlook/Outlook Express mail folders (.dbx, .mbx), the sent items file from Netscape, and Windows address books (.wab), which are used by mail clients such as Microsoft Outlook and Microsoft Outlook Express,. The email message may have up to two attachments, and it has a randomly generated subject line and message body.

NOTE: In many cases this virus will "touch" files and send them out as email attachments. Such files do not contain viral code and should be considered clean. In such cases it is safe to delete the file and it would be prudent to inform the sender that their system has been infected by the virus.

Also Known As: I-Worm.Magistr, PE_MAGISTR.A, W32.Magistr@mm, W32.Magistr.24876.int, W32/Disemboweler, W32.Magistr.corrupt, W32/Magistr-A

Type: Virus, Worm

Infection Length: varies

Virus Definitions: March 13, 2001

Threat Assessment:

 

Wild: High

Damage: High

Distribution: High

Wild:

• Number of infections: 50 - 999
• Number of sites: More than 10
• Geographical distribution: Medium
• Threat containment: Moderate
• Removal: Moderate

Damage:

• Payload:
  • Large scale e-mailing: Uses email addresses from the Windows Address Book files and Outlook Express Sent Items folder.
  • Causes system instability: Overwrites hard drives, erases CMOS, flashes the BIOS.
  • Releases confidential info: It could send confidential Microsoft Word documents to others.

Distribution:

• Subject of email: Randomly generated text that can be up to 60 characters long.
• Name of attachment: One randomly named infected executable and several randomly selected text or document files
• Target of infection: All Windows PE files that are not .dll files.

Technical description:

When a file that is infected by W32.Magistr.24876@mm is executed, it searches in memory for a readable, writable, initialized section inside the memory space of Explorer.exe. If one is found, a 110-byte routine is inserted into that area, and the TranslateMessage function is hooked to point to that routine. This code first appeared in W32.Dengue.

When the inserted code gains control, a thread is created and the original TranslateMessage function is called. The thread waits for three minutes before activating. Then the virus obtains the name of the computer, converts it to a base64 string, and depending on the first character of the name, creates a file in either the \Windows folder, the \Program Files folder, or the root folder. This file contains certain information, such as the location of the email address books and the date of initial infection. Then it retrieves the current user's email name and address information from the registry (Outlook, Exchange, Internet Mail and News), or the Prefs.js file (Netscape). The virus keeps in its body a history of the 10 most recently infected users, and these names are visible in infected files when the virus is decrypted. After this, the virus searches for the Sent file in the Netscape folder, and for .wab, .mbx, and .dbx files in the \Windows and \Program Files folders.

If an active Internet connection exists, the virus searches for up to five .doc and .txt files and chooses a random number of words from one of these files. These words are used to construct the subject and message body of the email message. Then the virus searches for up to 20 .exe and .scr files smaller than 128 KB, infects one of these files, attaches the infected file to the new message, and sends this message to up to 100 people from the address books. In addition there is a 20-percent chance that it will attach the file from which the subject and message body was taken, and an 80-percent chance that it will add the number 1 to the second character of the sender address. This last change prevents replies from being returned to you and possibly alerting you to the infection.

After the mailing is done, the virus searches for up to 20 .exe and .scr files, and infects one of these files. Then there is a 25-percent chance, if the Windows directory is named one of the following:

• Winnt
• Win95
• Win98
• Windows

• Deletes the infected file
• Erases CMOS (Windows 9x/Me only)
• Erases the Flash BIOS (Windows 9x/Me only)
• Overwrites every 25th file with the text YOUARESHIT as many times as it will fit in the file
• Deletes every other file
• Displays the following message:
  
  
  
• Overwrites a sector of the first hard disk

Removal instructions:

To remove this worm:

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
3. If any files are detected as infected by W32.Magistr.24876@mm, choose Repair.
4. Modify the file Win.ini by removing any reference to an infected file from the run= line. In most cases, on a clean system, the run= line will not be loading anything.

CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure you modify only the keys specified. Please see the document How to back up the Windows registry before proceeding. This document is available from the Symantec Fax-on-Demand system. In the U.S. and Canada, call (541) 984-2490, select option 2, and then request document 927002.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the key

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run

4. In the right pane, delete the value which references a file infected by W32.Magistr.23876@mm.