McAfee AVERT raises assessment on Life Stages Worm from medium to high risk

McAfee AVERT (Anti-Virus Emergency Response Team), a division of Network Associates, this morning upgraded to a high risk assessment on the recently discovered Life Stages worm. This destructive virus has the potential to create email storms leading to network performance slowdowns and has the ability to install extraneous content on users systems that can significantly deplete system memory.

"AVERT re-assessed the Life Stages worm, which arrives as a joke about the male and female stages of life, from medium to high risk, due to a proliferation of samples submitted to the lab late this afternoon. So far, the worm has been found at more than 100 customer sites, many of which are large, global enterprises," states Lloyd Wood, MD at Network Associates SA.

Life Stages is a multi-application Internet worm that exploits several mechanisms: Pirch, Outlook and mIRC, as well as available mapped drives. The worm arrives by email from an infected user to the recipient`s desktop in the form of an email with many different subject lines including: "Funny". The body of the email contains the text: "The male and female stages of life," and has the file: "LIFE_STAGES.TXT.SHS" attached.

The "SHS" attachment extension remains hidden even if the user`s operating system is set to show file extensions. According to Wood, "this unique feature may confuse users into believing the file is legitimate." In addition, the attachment is one of the most unpredictable file types because it can appear to be anything from an authentic file to a Trojan virus application.

Once the attachment is opened, the worm creates files of random names throughout the local system and all available drives. The random combination of names results in 10000 possible file variations that can lead to significant loss in memory capacity. In concert, the Life Stages worm emails itself to everyone in the user`s Microsoft Outlook address books, which can create a flood of emails that bottleneck and incapacitate the system.

"Unlike previous worms, users who have opened the attachment can read the actual Life Stages joke in the body of the email while their systems are being corrupted by the malicious code. This unique feature makes the Life Stages worm especially detrimental to unsuspecting users because it can perform a great deal of undetected damage," explains Wood.

Immediate cures for this virus can be found online at www.McAfeeB2B.com. McAfee users should employ the extra.DAT file with the latest scanning engine to stop potential email storms, which can crash systems. In addition, Microsoft Exchange users can download the GroupShield Exchange On-Demand Console from the McAfee B2B website for immediate detection and cleaning of the Life Stages worm.