Virus shuts email servers but spreads slowly
A computer virus that masks itself as a text file hits several corporate networks, prompting security experts to issue warnings.
The so-called stages.worm virus comes in email attachments from messages containing one of 12 randomly generated subject lines, including "Funny" and "Jokes." Like the "I Love You" and Melissa viruses, stages.worm replicates itself through Microsoft's Outlook Express email program. It also targets
IRC (Internet Relay Chat) and America Online's ICQ instant messaging service.
The attachment shows up as LIFE_STAGES.TXT.
According to reports, the virus had caused email systems shutdowns at four Fortune 100 companies yesterday. Antivirus software company Network Associates raised its warning on the "stages" worm from "low" to "high" based on the number of infections reported, according to the company?s Web site.
Vincent Gullotto, director of Network Associates' Anti-Virus Response Team (AVERT), said yesterday that about 50 customers reported seeing the virus.
"We found the virus two weeks ago and assessed its risk as low," Gullotto said. "But over the weekend we had a couple of large global corporations report the virus, and then...numbers started to mount."
The virus does not destroy files or otherwise damage computer systems, he added.
A notice posted on Symantec's Web site said that the virus could potentially overwhelm email servers.
A project manager at Symantec's antivirus research center said yesterday that his company had received close to 100 reports of infection since the worm first surfaced, but that this was "peanuts" compared to its fast-spreading predecessors such as Melissa or I Love You.
Like earlier examples of malicious programming, the worm has managed to take down a few corporate mail servers. If the virus is activated, it sends a copy of itself to every address found in an infected computer's address book.
The LIFE_STAGES.TXT attachment is a Shell Script object file, according to a report on the virus posted at Network Associates' Web site. Shell Script files carry the extension "SHS," but the extension is not normally displayed, making it easy to disguise.
Gullotto said computer users should not assume they can tell whether an attached file is safe simply by looking at the file type. He pointed to two other recent examples of disguised malicious files, Downloader and Backdoor G2, which erroneously appeared to be video files with "AVI" extensions.
The attachment includes a series of jokes about how dating changes as people get older.
The "life stages" worm masks itself as a text file, ordinarily among the most innocuous of email attachments.
Experts warned that computer users should be cautious even of these in the future, unless the content of the attachment is known in advance.
The Associated Press contributed to this report.