McAfee.com Warns of W32/Magistr.b@mm Virus in Europe, S. America
SUNNYVALE, Calif., Sept. 6 /PRNewswire/ — McAfee.com (Nasdaq: MCAF) today announced that it has received a serious number of reports from both South America and Europe of a virus that’s been infecting users over the last 48 hours. This virus, named “W32/Magistr.b@mm,” is a variant of “Magistr.a” and has been rated “medium risk” for corporate and home users due to the number of reports coming from the two continents. So far, the company has received relatively few reports coming from within the United States. McAfee.com has posted removal instructions for this virus on its Web site, available at www.mcafee.com. The company’s virus detection and deletion services, Clinic and VirusScan Online, have also been updated to protect current subscribers to these services. Over 30% of McAfee.com’s subscribers are outside the US.
W32/Magistr.b@mm is a variant of the W32/Magistr.a@mm, with a more complex encryption technique and some additional characteristics. These include the deletion of all .NTZ files on the local hard drive, the possible termination of the ZoneAlarm firewall program, and the use of random file extensions on the executables that it distributes. The virus has also been reported to retrieve email addresses from Eudora mailbox files (.MBX), overwrite the WIN.COM/NTLDR file, and send .GIF files found on the local machine to others along with itself.
In addition, the virus has maintained some characteristics of its predecessor, including the ability to use mass mailing techniques to send itself to email addresses stored in several places. These email addresses are gathered from the Windows Address Book, Outlook Express mailboxes, and Netscape mailboxes (addresses found in email messages within existing mailboxes may also be gathered). The messages sent by the worm contain various subject headings, body text, and attachments. The body of the message is derived from the contents of other files on the victim’s computer. It may send more than one attachment and may include non .EXE or non-viral files along with an infectious .EXE file.
In the last seven days, McAfee.com has measured the overall rate of infection of the W32/Magistr variants. With all variants combined, the company has seen a 12% infection rate worldwide, with 6% in South America, 12% in Europe, 10% Australia and 13% North America. The sample size is approximately 150,000 computers.
Further information and protection from this virus can be found at www.mcafee.com.
About McAfee.com
Headquartered in Sunnyvale, California, McAfee.com Corporation, a majority-owned subsidiary of Network Associates (Nasdaq: NETA), is a leading provider of Web security services, redefining how software is developed, delivered and experienced by PC users at home and at work. The company delivers software benefits through an Internet browser, virtually eliminating the need to install, configure and manage the technology on a local PC or network. McAfee.com hosts software application services on its vast technology infrastructure and provides these services to users online through its Web site www.mcafee.com. McAfee.com has signed up more than 1,000,000 paid subscribers and regularly has more than 800,000 visitors each day. The company estimates that 30% of its subscriber base is international. For more information, contact McAfee.com at 408.992.8100 or visit http://www.mcafee.com.