|
Virus Alert from Trend Micro:
High Risk Assessment on VBS_Stages.A
Trend Micro offers free
fixes, updated protection to customers
Cupertino, CA - June 19, 2000
- Trend Micro Inc. (Nasdaq:TMIC), announces the immediate
availability of protection for the VBS_Stages.A (a.k.a.
IRC_STAGES.A and SHS_STAGES.A) virus, a fast-spreading
Trojan worm that affects Windows machines and may arrive via
email with a scrap (Shell Scrap Object or SHS) file
attachment named LIFE_STAGES.TXT.SHS.
According to Microsoft, a
scrap is a file that is created when you drag part of a Word
or Excel document to the desktop; In the case of
VBS_Stages.A, this scrap file can easily fool the user into
believing it is an innocent text file because the extension
is not shown and the file assumes the icon of a text file.
Once the attachment file is opened, the virus renames and
deletes REGEDIT.EXE files and spreads by itself via
Microsoft Outlook email, Pirch and mIRC, (Internet relay
chat programs) and available mapped drives. Because of its
fast-spreading nature, VBS_Stages can quickly overload email
servers.
The VBS_Stages.A worm can
arrive with any of the following subject headings: Funny,
Fw:Funny, Life stages text, Funny text, or Fw:Funny text.
The message body can say either "The male and female
stages of life"; or "The male and female stages of
life. Bye."
When the attached scrap file
(LIFE_STAGES.TXT.SHS) is executed, the virus invokes notepad
to display a text file that takes a humorous look at the
stages of life of both male and female. During this time,
the virus installs itself in the system.
By late Friday afternoon,
four incidents of the virus had been reported by major US
corporations on both the east and west coasts. Over the
weekend, additional customer sites in India, Australia and
the United States reported infections. For this reason, the
risk assessment was increased from medium to high on Sunday.
The virus has the potential to spread very rapidly via
Outlook email and overwhelm email servers .
Solutions and reporting
tools from Trend Micro
- Trend Micro customers can
download the latest Trend pattern
file (#731 and above ) and scan
engine (#5.17) to detect and block this virus.
- Email systems can be set
to block any file with an SHS extension. SHS files,
i.e., Windows scrap files, are dangerous because they
can contain executable code. By default, the SHS or
scrap file extension will not be shown, so users would
not know they are opening a file containing executable
code. Trend's ScanMail(tm) and InterScan(r) eManager(tm)
products can be used to block select file attachments,
including SHS file attachments.
- Users can download and
install Microsoft's Outlook email security update
available at Microsoft's web site to block files with
SHS extensions
- Organizations who do not
currently use Trend Micro products may download free
evaluation software and pattern file updates to protect
email and desktop systems against this and other
viruses. Visit http://www.antivirus.com/products
for more details.
- Desktop users can scan
their computers for free for suspected viruses with
Trend Micro's HouseCall, a free online scanning service,
found at http://housecall.antivirus.com.
- To submit suspected virus
files to Trend Micro for analysis, please email the
Virus Team at virus_doctor@trendmicro.com.
Tracking occurrences or new variants will allow Trend
Micro to better serve the IT community.
For more information on the
VBS_Stages.A and how it can be stopped, please consult Trend
Micro's Virus Information Center at http://www.trend.com/pc-cillin/vinfo/.
About Trend Development
and Support Center (TDSC)
The Trend Development and Support Center (TDSC) in
Manila, Philippines is Trend Micro's primary facility for
antivirus research and global technical support. Established
in 1998, it currently employs over 230 people, including
more than 200 engineers. TDSC operates around the clock to
ensure that all Trend Micro customers, anywhere in the world
are covered by 24-7 service and support.
About Trend Micro
Trend Micro Inc. provides centrally controlled
server-based Internet content security products to the
enterprise and service providers worldwide. By protecting
information that flows through Internet gateways, email
servers, and file servers, Trend Micro allows companies
worldwide to stop viruses and other forms of content from a
central point before they ever reach the desktop.
Trend Micro's corporate
headquarters are located in Tokyo, Japan, with business
units in North and South America, Europe, Asia, and
Australia. The North American head office is located in
Cupertino, CA. Trend Micro's products are sold directly and
through a network of corporate and value-added resellers.
Evaluation copies of all of
Trend Micro's products may be downloaded from its
award-winning site, http://www.antivirus.com.
Web site visitors may also test-drive products online
through Trend Micro's Virtual Lab.
For additional
information, media can call:
- Dan Schrader
Chief Security Risk Analyst
Cell Phone: 408-393-4820
- David Perry
Public Education Director for Trend Micro
Pager: 800-469-4409
- Sandi Morgenthaler
Tel: 408-863-6361
Email: sandi_morgenthaler@trendmicro.com
|
