Virus Profile: W32/Magistr.a@MM

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

- Icons on the desktop move when the mouse cursor passes over them.
- Increase in size of .EXE files (adds 24Kb or more).
- Infected files use a modified access date of the time of the infection.
- Presence of a newly created .DAT file containing email addresses (representing those users which were sent the virus).
-Entry in WIN.INI RUN=(App).
-Entry in Registry, run key value:
HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\AppName (varies)=C:\WINDOWS\SYSTEM\(App).EXE (varies).

Methods of Infection

This worm arrives as an .EXE file with varying filenames. Executing this attachment infects your machine which is used to propagate the virus.

When first run, the virus may copy one .EXE file in the WINDOWS or WINDOWS SYSTEM directory using the same name with an altered last character.

For example, CFGWIZ32.EXE becomes CFGWIZ31.EXE, PSTORES.EXE becomes PSTORER.EXE, etc (this naming convention seems to be consistent where the last character of the filename is decreased by a factor of 1) .

This copy is then infected and a WIN.INI entry, or a registry run key value may be created, to execute this infected file upon system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
CFGWIZ31=C:\WINDOWS\SYSTEM\CFGWZ31.EXE

This copied executable infects other PE .EXE files in the SYSTEM directory and subdirectories, when run. It also infects over open network shares.

This virus will create a .DAT file on the local file system which contains strings of the files used to grab email address from (.dbx, .mbx, .wab), and also strings of email addresses which will be used as a target list. The .DAT file will be named after the machine name, but in an offset method. For instance, here is a corresponding list of letter equivalents used:

original letter corresponds to a -> y b -> x c -> w d -> v e -> u f -> t g -> s h -> r i -> q j -> p k -> o l -> n m -> m n -> l o -> k p -> j q -> i r -> h s -> g t -> f u -> e v -> d w -> c x -> b y -> a z -> z

Numbers are not affected. So a machine name of ABC-123 would have a .DAT file on the local system named YXW-123.DAT.

An additional item of note is that this worm often alters the REPLY-TO email address when mailing itself to others. In a similar fashion to the other name changes made by this virus, one letter of the address is incremented or decremented. Thus when attempting to contact the infected user to alert them, the message is often returned do to this address modification.