The return of "Magistr." (VIRUS NOTES).

Kaspersky Labs, who warns about the detection of the new variant of the dangerous "Magistr", virus, has already received several reports regarding infection in Spain by this malicious program. This variant is characterized by exclusively dangerous side effects, and also noticeably reworked virus spreading procedures via the local network and e-mail. In addition to destroying all files on the local and network disks, corrupting data stored in the CMOS memory (the computer hardware boot-up parameters) and FLASH BIOS microchip, "Magistr.b" overwrites the OS-loaders WIN.COM and NTLDR in such a way that under certain conditions upon the next computer start-up, all data on the local and network disks are deleted. While searching for target files to be infected, the virus also destroys files with the NTZ extension. Also, if `Magistr.b" detects the active copy of `ZoneAlarm' personal firewall software running it automatically disables it.

In order to obtain e-mail addresses for the further spreading, `Magistr. b' scans the databases of Eudora, Outlook Express, Netscape Messenger, Interact Mail e-mail clients and the Windows address book. The virus, as an addition to DOC and TXT file formats, is able to attach GIF files as well. In addition, a wide search is conducted for accessible network resources where `Magistr. b" will try to plant its copies. The virus searches the following folders: `WINNT', `WINDOWS", `WIN95', "WIN98', "WINME', WIN2000", `WIN2K', and `WINXP." In this way, the virus is able to more effectively spread and noticeably improve its rate of "success' in penetrating victim computers.

www.kaspersky.com