Virus Advisory - W32/Magistr.b@MM Updated 9/06/01

A version of the W32/Magistr.a worm, W32/Magistr.b, has been seen "in the wild".The worm may arrive via email or through network shares. W32/Magistr.b is reported to infect .bat, .com, .exe, .pif files and delete files with the .ntz extension. W32/Magistr.b is reported to terminate the ZoneAlarm firewall program if is running. It is also reported to retrieve email addresses from Eudora mailbox files (.MBX), overwrite the WIN.COM/NTLDR file at times, and send .GIF files found on the local machine to others along with itself.

In email form W32/Magistr.b arrives with a random subject line. The attachment also has a random name with an .EXE extension.

Subject: (Random)
Attachment: (Random).EXE

W32/Magistr.b also spreads through open shares.

For more information see:

• http://vil.nai.com/vil/virusSummary.asp?virus_k=99199

This archive is not intended to be comprehensive. For a more complete virus library, please visit NAI's Virus Information Library at http://vil.nai.com.