Date: Thu, 22 Mar 2001 16:26:21 -0500 (EST) From: BCPL.NET SysAdmin To: BCPL.NET News Subject: BCPL.NET NEWS: Virus Alert: Magistr Worm ----------------------------------------------- VIRUS ALERT: EXTREMELY DESTRUCTIVE MAGISTR WORM ----------------------------------------------- A new virus (actually a worm) called "Magistr" is beginning to spread across the Internet via e-mail. PC users should consider it extremely dangerous because it can render an infected PC virtually unusable. Magistr's primary method of spreading is in the form of an e-mail with one or more file attachments. The e-mail's subject line is randomly chosen and the body of the message uses text taken at random from files found on the sending PC, so there is no easily-discernible characteristic for the recipient to be on the alert for. The message includes at least one file attachment (the infected executable file), but may also include as many as five text files or Microsoft Word documents chosen at random from the infected PC's hard disk. Magistr infects the recipient's PC if he/she opens the infected file attachment. It looks for Outlook, Outlook Express and Netscape address books on the PC. If found, it sends infected e-mail as described above to all addresses in those address books. If the PC is on a network, Magistr looks across the network for PCs with shared-out drives. If found, Magistr infects those PCs. Magistr then goes to sleep, some sources say for as long as a month. When it wakes up, it overwrites all disk files on all local and accessible network drives. On some PCs Magistr may also erase CMOS, Flash Bios and hard drive data. See the following URLs for detailed information about Magistr: http://www.europe.f-secure.com/v-descs/magistr.shtml http://vil.mcafee.com/dispVirus.asp?virus_k=99040& http://www.symantec.com/avcenter/venc/data/w32.magistr.htm http://www.pcworld.com/news/article/0,aid,44686,00.asp As I have cautioned before, be very wary of any message containing a file attachment. If you receive a message containing an unexpected file attachment, delete it. Do not open the attachment! -- BCPL.NET INTERNET SERVICES CONTACTS: ----------------------------------- Web Site: http://www.bcpl.net Administration & Policy: ispadmin@bcpl.net 410-887-6180 Sales, Renewals, Account Status: accounts@bcpl.net 410-887-4172 Technical Support (Help Desk): help@bcpl.net 410-887-3297 Usenet News Newsgroup Requests news-admin@bcpl.net 410-887-6180 E-Mail & Newsgroup Abuse Reports: abuse@bcpl.net 410-887-6180 Domain Name Service Issues: dnsadmin@bcpl.net 410-887-6180 FAX: 410-887-2091