Article ID: 309532
Article Last Modified on 1/31/2007
APPLIES TO
- Microsoft Windows Millennium Edition
- Microsoft Windows 98 Second Edition
- Microsoft Windows 98 Standard Edition
- Microsoft Windows 95
This article was previously published under Q309532
Important This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect your system.
SUMMARY
This article describes how to determine whether your computer is infected with the W32.Magistr.24876@mm virus.
MORE INFORMATION
The W32.Magistr.24876@mm virus is an e-mail virus that is received as an e-mail attachment. Once it infects your computer, it can automatically send itself to your e-mail contacts, as well as delete or damage files on the local computer.
Symptoms of Infection
Desktop Icons Move Away from the Mouse Pointer
When your computer has been infected with this virus for approximately 60 days, desktop icons may appear to "avoid" the mouse pointer. That is, the desktop icons appear to move away from the mouse pointer. If the desktop icons move when you attempt to position the mouse pointer over them, your computer may be infected with the W32.Magistr.24876@mm virus.
A .dat File Is Created
When this virus infects the computer, it creates a .dat file with a name that is comprised of seemingly random letters. This file name is created by switching letters of the computer name with the corresponding letters from the following list:
A = Y
B = X
C = W
D = V
E = U
F = T
G = S
H = R
I = Q
J = P
K = O
L = N
M = M
N = L
O = K
P = J
Q = I
R = H
S = G
T = F
U = E
V = D
W = C
X = B
Y = A
Z = Z
NOTE: Numbers in the computer name are not affected.
To determine whether your computer contains this file, follow these steps.
Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
Note An antivirus program is designed to help protect your computer from viruses. You must not download or open files from sources that you do not trust, visit Web sites that you do not trust, or open e-mail attachments when your antivirus program is disabled.
For additional information about computer viruses, click the following article number to view the article in the Microsoft Knowledge Base:
129972Computer viruses: description, prevention, and recovery
NOTE: Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
- Click Start, point to Settings, and then click Control Panel.
- Double-click Network.
- Click the Identification tab.
- Record the name that is displayed in the Computer name box, and then click Cancel.
- Match the letters of the computer name that you recorded with the previous list of letters to determine the name of the .dat file that the virus creates. For example, if the computer name is Sales-123, the virus creates the following file name:
Gynug-123.dat
- Click Start, point to Find, and then click Files or Folders.
- In the Named box, type the .dat file name that you created in step 5. For example, type Gynug-123.dat.
- In the Look in list, click My Computer, and then click Find Now. If you find the file on the computer, your computer may be infected with the W32.Magistr.24876@mm virus.
Microsoft does not provide software that can detect or remove computer viruses. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software. For a list of antivirus software manufacturers, click the following article number to see the article in the Microsoft Knowledge Base:
49500 List of Antivirus Software Vendors
Additional query words: magistr virus contacts attachment 24876 random icon movement tag ipf
Keywords: kbinfo kbui KB309532
