Symantec Provides Detection for Fast-Spreading VBS.Stages.A Polymorphic Computer Worm

Business Wire, June 19, 2000

Business Editors/High-Tech Writers

CUPERTINO, Calif.--(BUSINESS WIRE)--June 19, 2000

Symantec Corporation (Nasdaq:SYMC), a leader in Internet security technology, today announced detection for VBS.Stages.A, a new and fast-spreading polymorphic computer worm.

Symantec's Anti-Virus Research Lab gives this worm a Category 4 rating, as it has potential to be difficult to contain, and cause severe damage.

This worm appears as a .TXT file attachment titled LIFE_STAGES.TXT.SHS. that disguises an .SHS file. An .SHS file is a Microsoft Scrap Object file which are executable files that can contain a wide variety of objects. The scrap object (SHS) extension does not appear in Windows Explorer even if all file extensions are displayed.

When executed, the attachment will open a text file in the Notepad that describes the male and female stages of life. While the user is reading the text file, the script executes in the background, moving the REGEDIT.EXE file to the recycle bin as a hidden system file named RECYCLED.VXD. -- resulting in modification of the SYSTEM REGISTRY and REGEDIT.EXE files that cause system instability.

VBS.Stages.A spreads itself like VBS.LOVELETTER.A, sending mail to a users' entire MS Outlook address book with a randomly generated subject line, which can overload mail servers. Additionally, the worm spreads itself via ICQ, mIRC and PIRCH and copies itself to mapped drives. The subject line may be one of 12 combinations and in some cases begins with "FW." The subject line will contain either "Life stages," "Funny" or "Jokes" or several combinations of these. This worm immediately deletes copies of the sent emails to ensure there is no record of its presence.

Symantec recommends that computer users do not attempt to open the attached document, and protect themselves by using Norton AntiVirus For Gateways to filter out all incoming emails that have attachments with .SHS extensions. New definition sets are now available to detect VBS.Stages.A and Norton AntiVirus users can download them through Symantec's LiveUpdate feature, or from the Symantec Web site at www.symantec.com/avcenter/download.html.

SARC, Symantec's AntiVirus Research Center, is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec

Symantec, a world leader in Internet security technology, provides a broad range of content and network security solutions to individuals and companies. The company is a leading provider of virus protection, risk management, Internet content and e-mail filtering, and mobile code detection technologies to enterprise customers. Headquartered in Cupertino, Calif., Symantec has worldwide operations in more than 24 countries.

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Center at http://www.symantec.com/PressCenter/ on Symantec's Web site.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders. All prices noted are in US dollars and are valid only in the United States.