Article View: alt.comp.virus
Article #471Re: I-Worm.Magistr?
From: Michael Salem
Date: Thu, 31 May 2001 09:20
Date: Thu, 31 May 2001 09:20
30 lines
2509 bytes
2509 bytes
Tonja wrote:
> After downloading "kaspersky lab's avp" the following was found:
> (my former virusscanner didn't find infected files though)
>
> C:\WINDOWS\Application
> Data\Identities\{6BF20820-9DF2-11D8-B641-B90EF3CAED54}\Microsoft\Outlook
> Express\Postvak IN.dbx/
> [From: mail@tonja.nl][Date: Sun, 6 May 2001 21:00:07 +0200 (MET
> DST)]:\IDLE32.EXE infected: I-Worm.Magistr
>
> I think this is about a mail I received from somebody I don't know. It
> didn't have an attachment but the text in the mail was in some code.
> After deleting the mail I scanned my system for the second time and nothing
> was found. Isn't that strange?
Been there, done that, but with a different virus. If your setup
supports HTML in email (in my view it shouldn't) and if your system
is set up to support scripting (in my view it usually shouldn't), you
can get infected by a script embedded in an HTML message, with no
need for an attachment.
If your virus scanner first reports a virus and cleans it; a later
report finds no virus; but you still see signs of infection, it means
the scanner doesn't deal properly with this virus. Quite common with
new viruses; later versions of scanners do better.
HTH,
--
Michael Salem
Technical Details
Message-ID:
<20010531.0920.20925snz@michaels.demon.co.uk>Path:
arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!dispose.news.demon.net!news.demon.co.uk!demon!mail2news.demon.co.uk!not-for-mailReferences:
<jobR6.147346$y7.904341@dbsch1.home.nl>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: fcd68,afd1dab4857ffe53 X-Google-Attributes: gidfcd68,public X-Google-Thread: 1036bc,afd1dab4857ffe53 X-Google-Attributes: gid1036bc,public X-Google-Thread: 1117bf,afd1dab4857ffe53 X-Google-Attributes: gid1117bf,public X-Google-Thread: 1054e1,afd1dab4857ffe53 X-Google-Attributes: gid1054e1,public X-Google-ArrivalTime: 2001-05-31 03:16:01 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!dispose.news.demon.net!news.demon.co.uk!demon!mail2news.demon.co.uk!not-for-mail From: 4ms2u$ms@michaels.demon.co.uk (Michael Salem) Newsgroups: alt.comp.virus,demon.tech.pc,alt.comp.viruses,symantec.support.win95_98.nortonantivirus.ver5.general Subject: Re: I-Worm.Magistr? Date: Thu, 31 May 2001 10:20:49 +0100 (BST) Organization: MCL Message-ID: <20010531.0920.20925snz@michaels.demon.co.uk> References: <jobR6.147346$y7.904341@dbsch1.home.nl> Reply-To: news@michaels.demon.co.uk X-Trace: mail2news.demon.co.uk 991304131 mail2news:394 mail2news mail2news.demon.co.uk X-Complaints-To: abuse@demon.net X-Mail2News-Path: news.demon.net!michaels.demon.co.uk X-Newsreader: SNews 1.31+mods(jlw010104/386) Lines: 31