Mcafee, Magistr.b, and local computer store

External Since: Jul 06, 2003 Posts: 2

I took my computer into a local store because of a problem getting a
graphics card to work that they'd just sold me. They told me that
they'd routinely scanned my hard drive for viruses and found magistr.b
in several directories. They claimed that this virus corrupts new
drivers as they are installed, and this is the reason the graphics
card would not run. It would cost me GBP 100 for them to clean the
disk.

I have Mcafee VirusScan product version 5.21.1000.1, engine version
4.1.60, virus definition file version 4.0.4236 (bang up to date). I
said no thanks, took the 'puter home, scanned the drive myself and
found no viruses. The computer store say that magistr.b has a stealth
mechanism that lets it hide from Mcafee running under Windows if the
virus is active, and that's why I can't detect it.

From what I've read Mcafee should have no trouble detecting magistr.b,
and the virus behaviour does not seem to agree with what the store are
telling me. Am I being given a come on, or could they conceivably be
dealing straight?

--
Dave...

External Since: Jul 04, 2003 Posts: 1719

Dave K:

Your McAfee; ENGINE (v4160), DATs (v4236) and Kernel (v5.2x) are all OLD !

The latest ENGINE is v4260, DATs are v4275 and Kernel is v7.x

However, you do meet the minimum requirements for the finding the infector
deemed "magistr"

As for drivers, well you didn't state the OS. Video drivers are seldom EXE
files.
I'll quote NAI McAfee "The viral code infects 32 bit PE type files (.exe) in the
WINDOWS directory and subdirectories."

I doubt that the store was correct in their assertion. The best way to know is
use another PC with the most current AV software. Either through a LAN scan the
supposedly affected system via a share to the root of drive "C:" or remove the
drive of the supposedly affected system and make it a "D:" drive of a second PC
with the most current AV software. Without executing anything on Dive "D:",
scan drive "D:". Just to make sure, do an "all-files" type of scan.

If you are clean, go back and confront the store manager. If you are not clean,
you have learned a lesson on virus stealth.

Dave