Win32.Magistr AKA "Disemboweler"
E-mail worm first discovered in March 2001. Intended to target people working in the legal system.
Magistr spreads through mailing copies of itself to e-mail addresses gathered from the database of mail clients on the victim's computer. The subject and text of the email might contain randomly selected words and phrases from documents found on the infected PC, possibly sharing private or confidential information. Infects Windows PE files when executed.
One month after infection, if at least 100 copies have been sent and at least 3 files on the victim's computer contain 3 examples from the list of phrases below, the first payload will be activated
[the list also contains these phrases in French and Spanish]
The payload overwrites every 25th file on local and networks drives with the text "YOUARESHIT" and deletes all other files. Then displays the infamous "Another haughty bloodsucker....... YOU THINK YOU ARE GOD, BUT YOU ARE ONLY A CHUNK OF SHIT" message and erases the CMOS, blue screening the computer. On Windows 95, 98 and ME, Magistr also erases Flash BIOS and hard drive data.
[Exe file overwritten with the text "YOUARESHIT" repeated as many times as possible. video source]
After 2 months since infection, on every odd day of the month, desktop icons are repositioned to "run away" from the mouse cursor:
[video source]
Text inside the body of the virus, added to the end of the infected file, reading "ARF! ARF! I GOT YOU! v1rus: Judges Disemboweler. by: The Judges Disemboweler. written in Malmo (Sweden)"
