All The World’s A Stages.Worm
‘Stages’ is the latest email-borne virus to targets users of Microsoft’s Outlook Express. Once slow-growing,…
‘Stages’ is the latest email-borne virus to targets users of Microsoft’s Outlook Express. Once slow-growing, the virus is racing around the globe this week, infecting thousands of computers. ‘Zulu,’ a veteran hacker believed to be living in Argentina, has already claimed credit for it. The virus, which looks like a harmless text file, has caused shutdowns of the e-mail systems at four Fortune 100 companies, anti-virus experts said. The virus does no harm to computer files, but in a similar way to May’s ‘Love Bug’, simply multiplies by sending itself out to everyone listed in the infected computer’s address book. Damage reports speak of temporary shutdowns of flooded computer networks. Stages hit companies in the United States by Friday and began appearing in Australia and Asia over the weekend, said David Perry of Trend Micro Inc., a maker of anti-virus software. Stages uses subject lines like ‘Funny’ and ‘Jokes’ to entice people to open a software attachment: LIFE_STAGES.TXT. The text of the message reads `the male and female stages of life,’ with an attachment, `life-stages.txt’ or `life-stages.txt.shs.’ In case you can’t contain yourself, the attachment contains a joke about advancing age whih is actually quite lame. Once opened, the virus automatically emails a copy of itself to random entries in the person’s address book and copies itself to computers linked to the PC via any local networks. While users are well-warned to steer clear of VisualBasic attachments, which appear as ‘.vbs’ extensions, Stages looks like a text file, complete with ‘.txt’ extension. But the real extension is ‘.shs,’ Windows Shell Scrap Object. A Scrap file can contain anything, including executable and malicious code. The ‘.shs’ extension does not appear even if a user sets Windows to show all file extensions. Microsoft designed this extension to be invisible, and it cannot be changed without entering the operating system’s most fragile configuration systems. Some sites have logged as many as 120,000 copies of Stages, leading some companies to shut down their email systems, said an official of the U.S.-funded computer security clearinghouse Computer Emergency Response Team. Delta Air Lines, the US’ third largest airline, closed down its corporate email system this week as a protective measure after detecting the virus on employee computers. Today computer systems were back in operation, but outside email was limited, a representative said. Zulu, who has taken credit as well for several well known viruses in recent years, including ‘Bubbleboy’ - named after a character in the ‘Seinfeld’ TV series - has been careful not to spread the virus directly. He posted his latest virus program to obscure sites where others have found and spread it on his behalf. In addition to Bubbleboy, Zulu has taken responsibility for the ‘Monopoly’ virus, which featured the logo of a Monopoly board game and Microsoft chairman Bill Gates holding up a fistful of cash. In late May, he posted the programming source code for ‘Stages’ on a virus news Web site along with a commentary about the virus that took credit for the work, said Bruce Hughes, a manager at computer security firm ICSA.net. The virus took several weeks to spread over networks. ‘He is considered on the cutting edge among virus writers,’ says Hughes. Sources suggest Zulu is in his mid- to late-20s and that he speaks Spanish and English.Users were first warned about the threat of stealthy ‘.shs’ files containing viruses in August 1998, but this is the first reported ‘.shs’ virus, according to virus experts.