We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,131 News Articles

'Stages' virus travels by Outlook

Fast-moving worm isn't destructive, but is well-disguised

Another e-mail worm, known as vbs_stages.a as well as irc_stages.a and shs_stages.a, has sped through businesses in Asia, North America, and Australia, and is now knocking at Europe’s door.

The e-mail appears to contain a joke outlining "the male and female stages of life," but once the attached file is opened, the virus inserts itself into Outlook and spreads itself via Outlook e-mail messages as well as mIRC and Pirch IRC (Internet relay chat) programs.

Stages is an .shs virus and uses SHS files, which are also known as shell or scrap files, to spread. SHS files are created when a clipping is taken from the middle of a Microsoft Word document and dropped onto the desktop, Perry says, noting that these are not text files even though they may appear to have a text file extension.

Like Melissa and the Love Letter virus, the Stages virus is a very fast replicator and can overload e-mail servers if a large number of copies hit a company all at once. The virus is also polymorphic, exposing itself multiple times in different formats to avoid detection.

The subject of the e-mail is randomly generated and can be one of twelve strings, according to antivirus researchers at Symantec. The subject line could be "Life Stages," "Funny," "Jokes," and others. The subject may begin with "FW" and may be followed by "text."

The worm sends an e-mail to addresses listed in your MS Outlook Address book containing the LIFE_STAGES.TXT.SHS attachment. Also, it immediately deletes copies of the e-mails after they have been sent, to ensure there is no record of its presence, according to Symantec.

Antivirus solutions vendors have updated their antivirus pattern files for download; Microsoft also has SHS blocking available in its Outlook e-mail security update.


IDG UK Sites

OnePlus Two release date rumours: Something's happening on 22 July

IDG UK Sites

13in MacBook Air review, Apple's MacBook Air 2014 reviewed

IDG UK Sites

5 reasons to buy an electric car and 5 reasons not to

IDG UK Sites

Evernote Skitch: the best way for creatives to doodle feedback