New computer Worm spreads fast, arrives in Malta

by David Kelleher

A computer worm, discovered a few months ago on a website, is making the rounds and is apparently more potent than originally thought.

The VBS.Stages worm, also known as "Life Stages", is ramping up around the world, especially affecting home PC users and students, who might not be as careful as corporate users in opening e-mail attachments.

The worm has also reached Malta and a number of reports have been made by local companies and individual users. Contacted yesterday, Mr John Portelli at TIM Ltd, said the virus had been identified back in January but started spreading over the past two days.

"At first it was listed as a known virus in January and reliable virus checkers were able to identify the worm. However, someone found the code on a website and sent it out," Mr Portelli told The Malta Business Weekly.

He added that the virus was classified as high risk, even though it did not cause particular damage to computer systems like the Love Bug virus did last month. the "Iloveyou" virus deleted all jpg files from the systems. It can potentially clog e-mail servers.

"The latest worm affects Microsoft Outlook Express, Pirch and Mirc. It attaches itself to an email and sends itself to all those in the address book," Mr Portelli said, adding that those who had anti-virus software installed and updated would not have any problems. The LifeStages worm can also spread itself through computer networks.

According to Computer Associates, the worm is a not as dangerous as the Love Letter but, compared to Melissa, "it is pretty significant".

Despite warning about the dangers of opening Visual Basic Script (VBS) attachments, experts believe that many are not heeding such warning. People are also unwilling to install anti-virus software.

Like the Love virus, the stages worm continues to spread because of its clever use of "social engineering" techniques and tricks users by putting catchy items in the subject line. The worm also changes subject headers, making it harder to pinpoint, observers said. Subject heads include: "Fw: Jokes", "Fw: Life Stages text", "Fw: Funny text", and "Fw: Jokes text", and "The male and female stages of life", the latter being reported in Malta.

Experts believe that the worm may be the work of a secretive software writer living in Argentina who has taken credit for key virus developments of recent years. "Zulu," a veteran hacker believed to be living in Argentina, has claimed credit for writing the virus. In late May, he posted the programming source code for "Stages" on a virus news Web site along with a commentary about the virus that took credit for the work.