Daily News Stages Worm Hits "Dozens" of Fortune 500 Firms By Dick Kelsey, Newsbytes June 21, 2000

As The Worm Turns. That could be the name of a real-life soap opera playing out in the lives of computer users around the world, as a fast-moving Trojan worm plays havoc with e-mail systems at dozens of Fortune 500 companies, an anti-virus expert said this afternoon.

The worm, called Stages, is disguised as a joke about the stages of life and spreads via Microsoft Outlook or Outlook Express e-mail systems in an attachment titled life_stages.txt.shs. It started quietly last Friday but has since spread worldwide, Trend Micro Inc.'s David Perry told Newsbytes. "Stages has gone from nothing to No.1 with a bullet," he said. It is not destructive, but clogs e-mail systems in a fashion similar to that of the Love Bug worm last month. The spread of Stages appears to be slowing down, he said, but not before it slithered into some large e-mail systems.

"It has spread to many big companies," said Perry, "dozens of Fortune 500 (firms), several Fortune 100, including top companies in aerospace, media, software, communications and securities." He declined to identify the companies but CNN reported that its system was among those infected.

The CERT Coordination Center at Carnegie Mellon University began monitoring Stages over the weekend. "Reports indicate the malicious code infects the local computer and attempts to redistribute the Shell Scrap Object file through email using a Microsoft Outlook address book," CERT said on its Web site today. If a user executes the attachment, a text file is opened in Notepad showing the male and female stages of life, and the program distributes itself as the user reads the file. Windows operating systems are configured to hide the .shs file extension from the user, so the file may appear as merely a text (.txt) file.

"If the company gets it, it'll bounce around," said Perry. "Everybody in the company gets a hundred copies of it." The best guard against the worm is not to open attachments inside e-mails with subject lines that read, FW: Life stages," "FW: Funny," "FW: Life stages text" or one of several other similar words and phrases, Perry said. Up-to-date anti-virus software can keep the infected messages out of e-mail boxes.

The creator of Stages appears to be "Zulu," the Argentine man who hatched the "Bubbleboy" virus last year, Perry said. "This guy's a smart guy," he said

http://currents.net/news/00/06/21/news2.html

-- Martin Thompson (mthom1927@aol.com), June 21, 2000