OMG I just got sent a virus!

[miriama59]

I am so thankful that my hotmail scans for viruses. I got the weirdest email: - PART 1 - BACKGROUND

- Starting with the date of origin and discovering the
emphasis on producing only new talent and work.

- Explain Bush Theatre
philosophy on taking huge risks associated with taking on new work.

- Share
the Bush Theatre legacy by surviving more than 25 years in the business to
become one of the most successful fringe theatres in the world

I HAVE TO ADMIT TO BEING EXTREMELY CURIOUS ABOUT IT AND GLAD THAT I WAS ABLE TO FIND OUT IT HAD A VIRUS. W32/Magistr@MM Virus Found

hAS ANYONE HEARD OF THIS VIRUS OR RECEIVED AN EMAIL LIKE THIS ONE?

[scooter22]

I never open mail unless I know who it is.... It's tempting though

[miriama59]

I know, I know!!!! It's just that the name on the email and the address sounded so familiar. And what a bizarre email. I kept trying to figure out what it is about.

[sushiosushi]

glad it didn't do any damage.

[Mouse7088]

Kriss...I know someone emailed me info on this, but I can't find it..they may have sent me a link and I didn't bookmark it..I did find this info tho...
(BTW...whew, glad you weren't infected babe..umm..that sounded kinda personal didn't it? LOL)..

Virus Name: W32/Magistr@MM
Date Added: 3/13/01 11:48:44 AM


Virus Characteristics:
Update May 30, 2001:
AVERT has observed a steady increase in the prevalence of this virus over the last week amongst end users. End users are advised to update their DAT files immediately to protect themselves from this threat.
W32/Magistr@MM is a combination of a files infector virus and e-mail worm.
-The viral code infects 32 bit PE type files (.exe) files in the WINDOWS directory and subdirectories.
-The worm part is using mass mailing techniques to send itself to email addresses stored in several places. The worm installs itself to run at each system startup.

Five minutes after the virus is run, it attempts a mailing routine. Email addresses are gathered from the Windows Address Book, Outlook Express mailboxes, and Netscape mailboxes (address found in the email messages within existing mailboxes are gathered), and these file locations and addresses are saved to a hidden .DAT file somewhere on the hard disk (varies). The messages sent by the worm contain varying subject headings, body text, and attachments. The body of the message is derived from the contents of other files on the victim's computer. It may send more than one attachment and may include non .EXE or non-viral files along with an infectious .EXE file.

The virus proceeds by infecting 32 bit PE (Portable Executable) type .EXE files found in the WINDOWS SYSTEM directory and subdirectories. The viral code is encrypted, polymorphic, and uses anti-debugging techniques to make it difficult detected. Email addresses have been seen encrypted in infected files. These addresses are believed to represent other users that have also been infected from the same point of origin.

In the decrypted body of the virus code, the following comments exist:

ARF! ARF! I GOT YOU! v1rus: Judges Disemboweler.
by: The Judges Disemboweler.
written in Malmo (Sweden)

W32/Magistr@MM has a payload routine that on some systems may result in cmos/bios info being erased as well as destroying sectors on the hard disk.

Virus Information:

Discovery Date: 3/12/01
Origin: Europe
Length: Varies, adds at least 24 Kb
Type: Virus
SubType: worm
Risk Assessment: Medium

Aliases
I-Worm.Magistr (CA), Magistr (F-Secure), PE_MAGISTR.A (Trend), W32.Magistr.24876@mm (Symantec) , W32/Disemboweler (Panda), W32/Magistr-a (Sophos)

Windows ME Info:
NOTE: Windows ME utilizes a backup utility that backs up selected files automatically to the C:\_Restore folder. This means that an infected file could be stored there as a backup file, and VirusScan will be unable to delete these files. These instructions explain how to remove the infected files from the C:\_Restore folder.

[Only registered and activated users can see links. Either login above or Register Now]

[miriama59]

Paula, thanks for the information. And let me add, thanks again for the help with Sarah's speech. She got all the information she needed from the links you supplied.



And if I can sneak this in, I am very sorry to see the "controversial" post closed. Seems like we finally got to have a real conversation and then it's gone. I miss those kinds of posts....