Hallo, mein Stiefvater hat zu mir gesagt, wenn ich ihm innerhalb von 3 Wochen einen Aufsatz über den Virus PE_magistr.a schreibe, bekomme ich einen Zuschuss für meinen PC. Dieser Virus hat uns gestern befallen, ich habe ihn aber gestern gecleant. Also, bitte schreibt soviel ihr über den Virus wisst: Funktionsweise, Tricks mit denen er Arbeitet, welche Routinen er abarbeitet, etc..
Alles was euch dazu einfällt
danke
(Anonym) nomis1 „ich habe bereits alle suchmaschinen von Google über Excite, Fireball und...“
Dann suchst du falsch oder kannst nicht lesen!
Description:
This memory-resident, polymorphic virus is similar to TROJ_MTX.A. It uses complex routines and anti-debugging techniques, which make it very difficult to analyze. It has both a virus component and a Trojan component that infect the local system as well as all files with .EXE and .SCR extensions. Upon execution, this Trojan infects Windows System files and then sends infected files via MS Outlook/Outlook Express/Netscape Navigator to all addresses listed in the infected user's Windows and Outlook Express address book. Its destructive payload trashes the primary hard disk drive controller, overwrites CMOS RAM, and erases flash memory (BIOS). Due to its polymorphic nature the email that this Trojan comes with does not have a static subject line, message body, or attachment filename.
Solution:
Click on Start|Run then type "REGEDIT"
Click on Edit|Find
In the input box, enter the name of the Trojan.
If the key/path is equal to the following registry, delete the value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Repeat from "step 2" for every Trojan detected in the system.
Scan system with your antivirus product and delete all files detected as PE_MAGISTR.A and replace infected system files from back up. Take note of the path and filename of the detected files.
Details:
This malicious program has a virus and Trojan component. The virus component is responsible for infecting the local system and staying memory resident, while the Trojan component is responsible for propagation via MAPI.
This virus uses per-process residency to become memory resident. In order to achieve this, it patches Windows Explorer in memory and adds some registry entries and some new entries in WIN.INI.
The following registry entry will be added:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
With the key:
