If you have already opened the attachment, contact the Technology Services Help Desk immediately at ext 4357 (HELP).

NIACC's Technology Services department has updated the email server in an attempt to prevent any future messages with these characteristics from being delivered. However, some infected messages may already have been distributed.

Virus Payload

W32/Magistr@MM is a combination of a files infector virus and e-mail worm.
-The viral code infects 32 bit PE type files (.exe) files in the WINDOWS directory and subdirectories.
-The worm part is using mass mailing techniques to send itself to email addresses stored in several places. The worm installs itself to run at each system startup.

Five minutes after the virus is run, it attempts a mailing routine. Email addresses are gathered from the Windows Address Book, Outlook Express mailboxes, and Netscape mailboxes (address found in the email messages within existing mailboxes are gathered), and these file locations and addresses are saved to a hidden .DAT file somewhere on the hard disk (varies). The messages sent by the worm contain varying subject headings, body text, and attachments. The body of the message is derived from the contents of other files on the victim's computer. It may send more than one attachment and may include non .EXE or non-viral files along with an infectious .EXE file.

The virus proceeds by infecting 32 bit PE (Portable Executable) type .EXE files found in the WINDOWS SYSTEM directory and subdirectories. The viral code is encrypted, polymorphic, and uses anti-debugging techniques to make it difficult detected. Email addresses have been seen encrypted in infected files. These addresses are believed to represent other users that have also been infected from the same point of origin.

In the decrypted body of the virus code, the following comments exist:

ARF! ARF! I GOT YOU! v1rus: Judges Disemboweler.
by: The Judges Disemboweler.
written in Malmo (Sweden)

W32/Magistr@MM has a payload routine that on some systems may result in cmos/bios info being erased as well as destroying sectors on the hard disk.

NIACC's Technology Services department has updated the email server in an attempt to prevent any future messages with these characteristics from being delivered. However, some infected messages may already have been distributed.

This information is also available on NIACC's Technology Services intranet page at http://www.niacc.edu/admin/ts/virusupdate_20010803.html.