Virus Alert from Trend Micro: High Risk Assessment on VBS_Stages.A; Trend Micro offers free fixes, updated protection to customers

Business Wire, June 19, 2000

Business/Technology Editors

CUPERTINO, Calif.--(BUSINESS WIRE)--June 19, 2000

Trend Micro Inc. (Nasdaq:TMIC), announces the immediate availability of protection for the VBS_Stages.A (aka IRC_STAGES.A and SHS_STAGES.A) virus, a fast-spreading Trojan worm that affects Windows machines and may arrive via email with a scrap (Shell Scrap Object or SHS) file attachment named LIFE_STAGES.TXT.SHS.

According to Microsoft, a scrap is a file that is created when you drag part of a Word or Excel document to the desktop; In the case of VBS_Stages.A, this scrap file can easily fool the user into believing it is an innocent text file because the extension is not shown and the file assumes the icon of a text file. Once the attachment file is opened, the virus renames and deletes REGEDIT.EXE files and spreads by itself via Microsoft Outlook email, Pirch and mIRC, (Internet relay chat programs) and available mapped drives. Because of its fast-spreading nature, VBS_Stages can quickly overload email servers.

The VBS_Stages.A worm can arrive with any of the following subject headings: Funny, Fw:Funny, Life stages text, Funny text, or Fw:Funny text. The message body can say either "The male and female stages of life"; or "The male and female stages of life. Bye."

When the attached scrap file (LIFE_STAGES.TXT.SHS) is executed, the virus invokes notepad to display a text file that takes a humorous look at the stages of life of both male and female. During this time, the virus installs itself in the system.

By late Friday afternoon, four incidents of the virus had been reported by major US corporations on both the east and west coasts. Over the weekend, additional customer sites in India, Australia and the United States reported infections. For this reason, the risk assessment was increased from medium to high on Sunday. The virus has the potential to spread very rapidly via Outlook email and overwhelm email servers.

Solutions and reporting tools from Trend Micro

-- Trend Micro customers can download the latest Trend pattern file (#731 and above ) and scan engine (#5.17) to detect and block this virus.

-- Email systems can be set to block any file with an SHS extension. SHS files, i.e., Windows scrap files, are dangerous because they can contain executable code. By default, the SHS or scrap file extension will not be shown, so users would not know they are opening a file containing executable code. Trend's ScanMail(tm) and InterScan(r) eManager(tm) products can be used to block select file attachments, including SHS file attachments.

-- Users can download and install Microsoft's Outlook email security update available at Microsoft's web site to block files with SHS extensions.

-- Organizations who do not currently use Trend Micro products may download free evaluation software and pattern file updates to protect email and desktop systems against this and other viruses. Visit http://www.antivirus.com/products for more details.

-- Desktop users can scan their computers for free for suspected viruses with Trend Micro's HouseCall, a free online scanning service, found at http://housecall.antivirus.com.

-- To submit suspected virus files to Trend Micro for analysis, please email the Virus Team at virus_doctor@trendmicro.com. Tracking occurrences or new variants will allow Trend Micro to better serve the IT community.

For more information on the VBS_Stages.A and how it can be stopped, please consult Trend Micro's Virus Information Center at http://www.antivirus.com/vinfo.

About Trend Development and Support Center (TDSC)

The Trend Development and Support Center (TDSC) in Manila, Philippines is Trend Micro's primary facility for antivirus research and global technical support. Established in 1998, it currently employs over 230 people, including more than 200 engineers. TDSC operates around the clock to ensure that all Trend Micro customers, anywhere in the world are covered by 24-7 service and support.

About Trend Micro

Trend Micro, Inc. provides centrally controlled server-based Internet content security products to the enterprise and service providers worldwide. By protecting information that flows through Internet gateways, email servers, and file servers, Trend Micro allows companies worldwide to stop viruses and other forms of content from a central point before they ever reach the desktop.

Trend Micro's corporate headquarters are located in Tokyo, Japan, with business units in North and South America, Europe, Asia, and Australia. The North American head office is located in Cupertino, CA. Trend Micro's products are sold directly and through a network of corporate and value-added resellers.

Evaluation copies of all of Trend Micro's products may be downloaded from its award-winning site, http://www.antivirus.com. Web site visitors may also test-drive products online through Trend Micro's Virtual Lab.