Magistr virus hits India

W32.Magistr.24876, a deadly virus that overwrites hard
drives and attempts to erase the Basic Input Output System (BIOS) providing
communication between the operating system and hardware, has finally hit India.
Chennai-based anti-virus provider, K7 Computing, has cited reports of the
symptoms of the virus discovered on March 13 from places as far as Kolkatta,
Chennai and Tuticorin.

Magistr, categorized both as a virus and a worm, spreads
by email, shared disks and on the local area network. Spread as an email
attachment with a size of at least 25-KB, it infects Windows Portable Executable
files except .dll system files when it is executed. It goes into memory using
Explorer.exe process. After waiting for three minutes, it infects a file in the
Windows directory to ensure that the virus is activated every time Windows is
rebooted.

It then sends emails to addresses gathered from the
Windows Address Book used by mail clients such as Microsoft Outlook, Microsoft
Outlook Express, the Outlook/Outlook Express Sent Items Folder and the Netscape
Address Book. It also spreads fast on the local area network infecting files in
the directories that are shared.

"In addition to being a deadly virus, Magistr
sometimes infects and attaches .doc or .txt file to the emails it sends out
which might result in the leakage of confidential files. It is similar to the
Kriz virus, based on the CIH virus, that gets activated on Christmas day,"
said J. Kesavardhanan, CEO, K7 computing.

"After sitting on the system for a month, Magistr
overwrites all disk files in the local and network drives making it almost
impossible to retrieve the lost data. The incubation period of one month gives
the virus enough time to multiply and spread the infection. We were on the
lookout for the virus in India after it hit the scene last week. We have updated
our Vx 2000 anti-virus to clean the Magistr virus and the updated version is
available in our site," he added.