New Virus Not So "Funny"
A new computer virus appears to be a plain-text file, but isn't as funny as it claims to be.
Experts say the virus, called "Stages," shut down e-mail systems at four Fortune 100 companies.
Clif Burwell, King County, Washington, operations manager for information and telecommunications services, told The Seattle Times the county's four e-mail servers were shut down around noon amid mounting complaints about the problem. The servers were back in service by 4 p.m.
The bug didn't damage any machines or destroy any important data "but it was a major inconvenience," Burwell said.
The new virus looks like a harmless text file. It does no harm to computer files, but like the recent "Love Bug" virus, it sends itself out to everyone listed on the infected computer's address book.
The e-mail message contains the words "funny," "life stages" or "jokes" in the subject line.
While users are well-warned about VisualBasic attachments, which appear as ".vbs" extensions, the so-called "Stages" virus looks like a text file, complete with ".txt" extension. But the real extension is ".shs," which stands for Windows Shell Scrap Object. A Scrap file can contain anything, including executable and malicious code.
The ".shs" extension does not appear even if a user sets Windows to show all file extensions. Microsoft designed this extension to be invisible, and it cannot be changed without entering the operating system's most fragile configuration systems.
One anti-virus expert says the "Stages" virus hit companies in the U-S Friday and began appearing in Asia and Australia over the weekend.
Makers of the popular McAfee anti-virus program reclassified "Stages" as a larger threat and said more than 100 of their customers many major companies and almost all based in the United States reported infections. One company had more than 5,000 individual users infected.
"Due to the infection rate, we're moving it to 'high risk,"' said Sal Viveros, a spokesman for McAfee said.
Viveros said an analysis of the virus showed that it was signed by someone named "Zulu," the same author that wrote the "Bubbleboy" virus that appeared last year.
CBSNews.com producers received copies of the e-mail messages. There are no reports of infection here.
Experts say do not open the attachment, just delete it. We'll save you the time and trouble: It contains a joke about advancing age.
Surprisingly, an anti-virus vendor first warned users about the threat of stealthy ".shs" files containing viruses in August 1998. But this is the first reported ".shs" virus, according to virus experts.
Anti-virus companies have issued software update to catch the new virus and are encouraging businesses to filter incoming mail and delete attachments with the ".shs" suffix.
©2000 CBS Worldwide Inc. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed. The Associated Press contributed to this report