Virus Alert - VBS_Stages
The McAfee Anti-Viral team sent word today of a new virus being spread rapidly through IRC and the use of Microsoft Outlook and the address book contained therein. This new virus has been assessed a High Risk alert by the team. Several companies have shut down their e-mail systems to combat the spread of the virus for now, while CERT officials say the virus is relatively benign. Microsoft and Visa rank amongst those companies hit by the worm yesterday.
The virus disguises itself as a joke, and carries the attached file LIFE_STAGES.txt. What the user doesn't see is the hidden .SHS extension which allows the malicious code to be run and the virus to spread itself. The .shs extension comes from the use of Windows scrap files, relatively unused in previous code.
The McAfee Dispatch is as follows:
IRC/Stages.worm is an Internet worm that began spreading rapidly on 6/19. McAfee AVERT has assessed it as a HIGH-RISK threat. McAfee.com Clinic users who used VirusScan Online
after 6/16 have protection against this worm. The worm uses Microsoft Outlook to send copies of itself to all entries in the address book and through installations of Pirch, ICQ and
mIRC.* It also spreads to all available mapped drives on your system.This worm will arrive in an email message with this format:
SUBJECT: "Funny", "Jokes", or "Life Stages", sometimes followed by "Text"
CONTENT: "The male and female stages of life"
ATTACHMENT: "LIFE_STAGES.TXT.SHS" (the suffix ".SHS" may be hidden)
If the attachment is run, the user sees a list of jokes while the worm infects the system and attempts to send copies of itself to all addresses in Outlook address book, as well as through the other channels mentioned above.
* Pirch is an internet relay chat client for Microsoft Windows 95/98/NT, mIRC is a shareware IRC chat client for Windows and ICQ lets you initiate IRC style chat sessions - it alerts you when your friends are online and lets you chat
with them.--McAfee.com
Those who have downloaded and installed the Microsoft security patch for Outlook are free from threat, as well as those who have run the online virus scan at McAfee since June 16th.
Keep checking back as the story develops. Visit McAfee.com for more details about the VBS_Stages worm.