Symantec Discovers New Computer Worm Infecting Thousands
Corporations worldwide infected by virus W32.Magistr.24876@mm
WHAT: Researchers at the Symantec AntiVirus Research Centre (SARC) have confirmed
W32.Magistr.24876@mm, an extremely fast-spreading polymorphic computer virus with email worm capability, is spreading
itself across Europe and is expected to reach New Zealand today.
This virus is particularly dangerous as the email message may have up to six attachments and has a randomly generated
subject line that has up to 60 characters, which makes identifying the virus very difficult as subject headings are
never consistent.
When launched or executed the worm uses Microsoft Outlook and Windows Address book to email itself to all recipients in
the users address book.
RECOMMENDATIONS/PROTECTION: Symantec customers can repair damage caused through the detection function within Norton
AntiVirus. Definitions are currently being developed and should be available by Thursday 15th March.
Customers will be able to download the definitions via LiveUpdate or from the Symantec website at
http://www.symantec.com/region/au_nz/avcenter/. SARC recommends that administrators filter for attachments with a VBS
extension immediately.
CHARACTERISTICS OF INFECTION: W32.Magistr.24876@mm is a polymorphic virus and worm that attempts the following:
1. Infect all executable Windows files that are not DLLs;
2. Spread via a STMP handler, meaning it does not need an e-mail client such as MS Outlook or Netscape to spread itself
like with other dangerous worms and viruses;
3. Gather e-mail address from the Windows address book and Outlook Express sent-items folders. It then attaches up to
any six random files and generates a random subject line that contains up to 60 characters;
4. It attempts to modify Win.ini files on network drives.
PAYLOAD: Preliminary findings indicate that the virus and worm has a very dangerous payload.
ABOUT SYMANTEC ANTIVIRUS RESEARCH CENTRE
(SARC): SARC is one of the industry’s largest dedicated team of virus experts. With offices located in the Australia/New
Zealand, United States, Japan, and the Netherlands. The center’s mission is to provide swift, global responses to
computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the
public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these
viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus
threats.
ABOUT SYMANTEC: Symantec, a world leader in Internet security technology, provides a broad range of content and network
security solutions to individuals and enterprises. The company is a leading provider of virus protection, risk
management, Internet content and e-mail filtering, remote management and mobile code detection technologies to
customers. Headquartered in Cupertino, Calif., Symantec has worldwide operations in more than 33 countries including New
Zealand. Symantec is represented in New Zealand by Auckland based distributor Tech Pacific.
For further press information please view http://www.symantec.com/region/au_nz/PressCenter/nz.html
CONTACT: