Magistr Detection & Clean

Magistr Detection & Clean is a handy tool that targets the Win32.Magistr.B@mm malware infection and removes it immediately.
This virus is an improved and more stable version of the Win32.Magistr.A@mm.
It\s decryption routine is more elaborate and the original data from the Entry Point is now encrypted with a key generated from the computer name. Because of this, cleaning the infected files is more difficult.
It is able to infect more computers connected in a network because it now looks for more Windows directory names than the previous version.
In network infection it searches for the following directory names:
WINDOWS
WIN95
WIN98
WINME
WINNT
WIN2000
WIN2K
WINXP
and infects the files in those directories. After that it registers itself in WIN.INI and SYSTEM.INI under the [Windows] and [Run] sections for WIN.INI and under [boot] and [Shell] sections for SYSTEM.INI.
On the local machine it adds itself in the registry under the following key: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
with the name of the first infected file and the value the path to that file.
This new version search for e-mail addresses in Eudora\s address book, in addition to the previous e-mail clients such as Outlook Express, Netscape and so on.
The texts for e-mail body are now in French too. The word used to compose the message are in the following list:
habeas corpus
judgement
condamné
trouvons coupable
à rembourse
sous astreinte
aux entiers depens
aux depens
ayant delibere
le present arret
vu l\arret
conformement a la loi
execution provisoire
ordonne
audience publique
a fait constater
cadre de la procedure
magistrad.
Now the virus sends trough e-mail not only doc files but .GIF images too. The virus checks for existence of ZoneAlarm firewall and if it exists, the virus terminates it.