Symantec provides detection for fast-spreading VBS.Stages.A polymorphic computer worm

Symantec, a leader in Internet security technology, yesterday announced detection for VBS.Stages.A, a new and fast-spreading polymorphic computer worm. Symantec's Anti-Virus Research Lab gives this worm a Category 4 rating, as it has potential to be difficult to contain, and cause severe damage. This worm appears as a .TXT file attachment titled LIFE_STAGES.TXT.SHS. that disguises an .SHS file. An .SHS file is a Microsoft Scrap Object file which are executable files that can contain a wide variety of objects. The scrap object (SHS) extension does not appear in Windows Explorer even if all file extensions are displayed. When executed, the attachment will open a text file in the Notepad that describes the male and female stages of life. While the user is reading the text file, the script executes in the background, moving the REGEDIT.EXE file to the recycle bin as a hidden system file named RECYCLED.VXD. - resulting in modification of the SYSTEM REGISTRY and REGEDIT.EXE files that cause system instability.

VBS.Stages.A spreads itself like VBS.LOVELETTER.A, sending mail to a users' entire MS Outlook address book with a randomly generated subject line, which can overload mail servers. Additionally, the worm spreads itself via ICQ, mIRC and PIRCH and copies itself to mapped drives. The subject line may be one of 12 combinations and in some cases begins with "FW."

The subject line will contain either "Life stages," "Funny" or "Jokes" or several combinations of these. This worm immediately deletes copies of the sent emails to ensure there is no record of its presence.

Symantec recommends that computer users do not attempt to open the attached document, and protect themselves by using Norton AntiVirus For Gateways to filter out all incoming emails that have attachments with .SHS extensions.

New definition sets are now available to detect VBS.Stages.A and Norton AntiVirus users can download them through Symantec's LiveUpdate feature, or from the Symantec Web site at www.symantec.com/avcenter/download.html.

SARC, Symantec's AntiVirus Research Center, is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC.

The center's mission is to provide swift, global responses to computer virus threats, proactively research and

develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.