Existence of a newly created DAT file containing email addresses may also indicate an infection. Do not confuse a Magistr DAT file with legitmate DAT files. Computer crashes when debugger is run. Desktop icons are repositioned away from the cursor on odd numbered days.
Computer is unbootable.
When an infected file is executed, Magistr makes a copy of an EXE or SCR file in the system directory and changes the name of the infected file. Once the infected file is run this process repeats, infecting multiple files in a short period of time on the affected computer. Magistr then uses it's own SMTP code to connect to a mail server directly, sending out emails to address stored in the DAT file mentioned above. Subjects are randomly generated from 1-5 DOC and TXT files and may be up to 60 characters long. These words are also used to construct the body of the email message.