>Hopefully it is a corrupted non voltile strain??? Don't want my 20 bucks for
>20 users to go to waste :)
I just had it tested in our virus lab, and when we try to run it (on NT) a
pop-up windows appears that says that it is not a valid Windows NT
application. Nor did it change the registry entries that it should
have. The Sophos tool to clean it did not report that the computer was
infected (although it did catch the virus in the accstat.exe program).
It does sound like it is corrupted, and would explain why some virus
scanners aren't catching it and some are.
I see two possibilities here:
[1] This is indeed a corrupted, non-executable (but real) virus.
[2] This is a new as-of-yet-unknown strain of the Magistr virus.
I'm guessing #1. Hopefully F-Prot will give their answer, as they will do
a much more in depth analysis than we did.
-Scott
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
