Computer Viruses

4 December 2001

Virus Warnings!
We have been advised by an IntelForum Member, that their personal computer became infected with the "W32.Magistr.39921@mm" virus.

The links below define this virus in more detail, and its predecessor virus V. 24876.

http://securityresponse.symantec.com/avcenter/
venc/data/w32.magistr.39921@mm.html
http://securityresponse.symantec.com/avcenter/
venc/data/pf/w32.magistr.24876@mm.html

This virus is also known by these names: I-Worm.Magistr, PE_MAGISTR.A, W32.Magistr@mm, W32.Magistr.24876.int, W32/Disemboweler, W32.Magistr.corrupt and W32/Magistr-A.

HIS.COM, the Internet Service Provider for the Intelligence Forum Listserve, does NOT provide anti-virus protection to List messages.

An infected message sent to the List and subsequently distributed to the List, stands the chance of advancing the infection to individual member personal computers which receive distributed List messages from IntelForum.

ALL List members should insure that their computer systems are adequately protected against this virus by running an anti-virus scan AS SOON AS POSSIBLE.

This virus affects the Microsoft Windows Operating System via its Windows Portable Executable (PE) files, and MS Outlook, MS Outlook Express, Eudora and Netscape Email Clients. Other operating systems and Email clients may also be susceptible.

Review the information provided at the links above for more information about this virus, its effects and ways to determine if your system has become infected, as-well-as ways to prevent infection from this and other computer viruses in the future.

If you believe your computer has become infected, DO NOT send messages to the Intelligence Forum List until your computer has been thoroughly checked and adequate anti-virus cleansing actions have taken place. As soon as you are certain that your system is virus-free, notify all persons who may have received Email from you during the period of time when the virus was likely to have lodged on your system, of this computer virus threat.

Anti-virus protection is the responsibility of each individual Intelligence Forum Member. We are most grateful to the I.F. Member who detected this virus on their computer system, for coming forth to alert all of us to this threat.

and speaking about VIRUS trouble. . .

This is quoted from a McAfee Virus Alert dated 4 December 2001 :

"McAfee.com has seen an OUTBREAK of computers infected with W32/Goner@MM, also known as Pentagone, Goner or Gone.  This is a NEW, HIGH RISK virus that spreads via Microsoft Outlook email and ICQ instant messaging programs.  This mass-mailing worm will arrive from someone you know with the following email message:

"Subject :    Hi

"Body :    How are you?  When I saw this screen saver, I immediately thought about you I am in a harry, I promise you will love it!

"Attachment :    GONE.SCR

"Goner has a DESTRUCTIVE PAYLOAD. When the attachment is opened, it will look for a variety of anti-virus, firewall and other security programs and attempt to delete them, along with ALL FILES in the same directory.  This worm will also place a trojan, REMOTE32.INI, on the system, which contains instructions to attempt Denial-of-Service attacks on other IRC users."

For detection and removal instructions for the W32/Goner@MM virus, click here:

http://www.mcafee.com/anti-virus/viruses/goner/default.asp?cid=2636

You should also check the following links for further information :

http://securityresponse.symantec.com/avcenter/
venc/data/w32.goner.a@mm.html
http://www.boardwatch.com/reuters/120401_gt10.htm
http://www.nipc.gov/warnings/alerts/2001/01-029.htm
http://www.cert.org/incident_notes/IN-2001-15.html

The U.S. FBI's National Infrastructure Protection Center and the independent Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon University, are also good resources to have handy regarding computer security and computer viruses.

For regularly updated summaries of the most frequent, high-impact types of security incidents and vulnerabilities currently being reported to the CERT/CC — including the two viruses reported in this alert — bookmark and check this link :

http://www.cert.org/current/current_activity.html.

PLEASE Remember & Understand : Anti-virus protection is the responsibility of each individual Intelligence Forum Member.

Back To Top

Intelligence Forum News : The World's War On Terrorism