W32.Magistr.24876@mm - Removal

Removal using the W32.Magistr Worm Removal Tool
Symantec Security Response has created a tool to remove W32.Magistr.24876@mm, which is the easiest way to remove this threat.

Manual Removal
To remove this worm, repair the files detected as W32.Magistr.24876@mm, and reverse the changes it made to the Windows registry or the Win.ini file.

NOTE: This worm attempts to erase CMOS and to flash the BIOS on Windows 95/98/Me-based computers. In most cases, this action is not successful. However, if the worm succeeds to perform this action, the computer will not properly start. In this case, contact the computer manufacturer for instructions on how to fix this.

Removing the worm

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and make sure that it is configured to scan all the files. For instructions on how to do this, read the document, "How to configure Norton AntiVirus to scan all files."
3. Run a full system scan.
4. If any files are detected as infected by W32.Magistr.24876@mm, write down the filenames, and then click Repair. Delete the files that cannot be repaired.

Editing the registry
There is a 75% chance that the worm has added a value to the registry. Follow the instructions in this section first. If you do not find a value that the worm added, proceed to the next section.

CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Make sure to modify the specified keys only. See the document, "How to back up the Windows registry," before proceeding.

1. Click Start, and then click Run. (The Run dialog box appears.)
2. Type regedit,,and then click OK. (The Registry Editor opens.)
3. Navigate to the key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\
   Windows\CurrentVersion\Run
   
   
4. In the right pane, delete the value that refers to a file that was detected as infected by W32.Magistr.24876@mm.

Editing the Win.ini file

1. Click Start, and then click Run.
2. Type the following:
   
   edit c:\windows\win.ini
   
   and then click OK. (The MS-DOS Editor opens.)
   
   NOTE: If Windows is installed in a different location, make the appropriate path substitution.
   
   
3. In the [windows] section of the file, look for the line that begins with: run=
   
4. To the right of the equal (=) sign, look for the text that refers to a file detected as infected by W32.Magistr.24876@mm.
5. Delete this text.
6. Click File, and then click Save.
7. Exit the MS-DOS Editor.

NOTE: This virus contains bugs that will corrupt some files while attempting to infect them, as well as when the first payload activates. These files cannot be repaired, therefore, restore them from a backup. (These files may be detected as W32.Magistr.corrupt.)

Technical Details