New computer virus spreading slowly

June 19, 2000 Web posted at: 6:59 PM EDT (2259 GMT)

NEW YORK (AP) -- A new computer virus disguised as a joke about male and female relationships has hit several large corporations, but security experts said it was spreading relatively slowly Monday.

The virus does not permanently damage computer files but can clog e-mail systems. It hit companies in the United States by Friday and began appearing in Australia and Asia over the weekend, said David Perry of Trend Micro Inc., a maker of anti-virus software.

The virus was spreading more slowly than the "Love Bug," which crippled computer systems around the world in a matter of hours when it struck in early May.

Like Love Bug, the latest virus automatically sends copies to everyone listed in the Microsoft Outlook program's address book. Both viruses can also spread through chat rooms.

But unlike Love Bug, the new virus uses a Windows feature called Shell Scrap Object to activate. The virus carries an ".shs" suffix, but Windows computers are generally configured to hide the suffix, making the file appear to contain only text.

The e-mail message contains "funny," "life stages" or "jokes" in the subject line. The text of the message reads "the male and female stages of life," with an attachment, "life_stages.txt" or "life_stages.txt.shs."

Anti-virus companies have issued software updates to catch the new virus and are encouraging businesses to filter incoming mail and delete attachments with the ".shs" suffix.

http://www.cnn.com/2000/TECH/computing/06/19/computer.virus.ap/index.html

-- Martin Thompson (mthom1927@aol.com), June 19, 2000

Answers

New PC virus causing shutdowns

By D. Ian Hopper The Associated Press June 20, 2000 5:01 a.m. CDT

WASHINGTON (AP) -- A new computer virus, which looks like a harmless text file, has caused shutdowns of the e-mail systems at four Fortune 100 companies, anti-virus experts said Monday.

The virus does no harm to computer files, but similar to May's ``Love Bug'' virus, simply multiplies by sending itself out to everyone listed in the infected computer's address book.

While users are well-warned about VisualBasic attachments, which appear as ''.vbs'' extensions, the so-called ``Stages'' virus looks like a text file, complete with ''.txt'' extension. But the real extension is ''.shs,'' which stands for Windows Shell Scrap Object. A Scrap file can contain anything, including executable and malicious code.

The ''.shs'' extension does not appear even if a user sets Windows to show all file extensions. Microsoft designed this extension to be invisible, and it cannot be changed without entering the operating system's most fragile configuration systems.

The virus hit companies in the United States by Friday and began appearing in Australia and Asia over the weekend, said David Perry of Trend Micro Inc., a maker of anti-virus software.

Since then, makers of the popular McAfee anti-virus program have reclassified ``Stages'' as a larger threat, and said more than 100 of their customers -- many major companies and almost all based in the United States -- reported infections. One company had more than 5,000 individual users infected.

``Due to the infection rate, we're moving it to 'high risk,''' said Sal Viveros, a spokesman for McAfee.

Viveros said an analysis of the virus showed that it was signed by someone named ``Zulu,'' the same author that wrote the ``Bubbleboy'' virus that appeared last year.

``Stages'' uses Microsoft Outlook or Outlook Express mail programs to spread, but it can also infect through chat rooms or America Online's ICQ instant messaging software.

The e-mail message contains ``funny,'' ``life stages'' or ``jokes'' in the subject line. The text of the message reads ``the male and female stages of life,'' with an attachment, ``lifestages.txt'' or ``lifestages.txt.shs.'' The attachment contains a joke about advancing age.

Surprisingly, an anti-virus vendor first warned users about the threat of stealthy ''.shs'' files containing viruses in August 1998. But this is the first reported ''.shs'' virus, according to virus experts.

Anti-virus companies have issued software updates to catch the new virus and are encouraging businesses to filter incoming mail and delete attachments with the ''.shs'' suffix.

http://cnews.tribune.com/news/tribune/story/0,1235,tribune-nation- 66748,00.html

-- Martin Thompson (mthom1927@aol.com), June 20, 2000.