Off topic: FYI: McAfee info. about Stages.worm virus

From: <Colin.Shaw_at_phs.com>
Date: Tue, 20 Jun 2000 09:06:08 -0700
Message-Id: <10534.109867@fatcity.com>

This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible.

------_=_NextPart_001_01BFDAD1.72A0BCE0

Content-Type: text/plain;
charset=iso-8859-1
Content-Transfer-Encoding: 7bit

(((((((((((((((((( McAfee.com Dispatch )))))))))))))))))))))

_______________________VIRUS ALERT__________________________

[This message is brought to you as a subscriber to the

McAfee.com Dispatch. To unsubscribe, please follow the

instructions at the bottom of the page.]

VIRUS ALERT - IRC/Stages.worm ********

Dear McAfee.com Dispatch Subscriber:

IRC/Stages.worm is an Internet worm that began spreading

rapidly on 6/19. McAfee AVERT has assessed it as a HIGH-RISK

threat. McAfee.com Clinic users who used VirusScan Online

after 6/16 have protection against this worm. The worm uses

Microsoft Outlook to send copies of itself to all entries in

the address book and through installations of Pirch, ICQ and

mIRC.* It also spreads to all available mapped drives on

your system.

This worm will arrive in an email message with this format:

SUBJECT: "Funny", "Jokes", or "Life Stages", sometimes

followed by "Text"

CONTENT: "The male and female stages of life"

ATTACHMENT: "LIFE_STAGES.TXT.SHS" (the suffix ".SHS" may be hidden)

If the attachment is run, the user sees a list of jokes

while the worm infects the system and attempts to send

copies of itself to all addresses in Outlook address book,

as well as through the other channels mentioned above.

Pirch is an internet relay chat client for Microsoft

Windows 95/98/NT, mIRC is a shareware IRC chat client for

Windows and ICQ lets you initiate IRC style chat sessions -

it alerts you when your friends are online and lets you chat

with them.

--McAfee.com

_______________________Virus Fixes__________________________

Find out more about this virus. Click here to go to the

IRC/Stages.worm Help Center.

-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1585

Become a McAfee.com Clinic subscriber and check your system

online. To use VirusScan Online, click here.

-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1586

Purchase the latest copy of VirusScan, please click here.

->
http://store.mcafee.com/category.asp?CatID=3&CategoryLevel=1&rfr=VSCALRT

Upgrade to the latest VirusScan. Purchase the VirusScan

Maintenance Plan which entitles you to 12 months of upgrades,

click here.

-> http://store.mcafee.com/category.asp?CatID=18&CategoryLevel=1&rfr=VRSPLN

Download the latest DAT files, click here.

-> http://download.mcafee.com/updates/updates.asp

____________________Clinic Subscribers______________________

If you are an ActiveShield user, get the latest update. Click here.

-> http://clinic.mcafee.com/clinic/virusscan/activeshield/start.asp

Surf the Web safely. Get McAfee.com Personal Firewall.

Click here.

-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1458

Subscribe: If this message has been passed on to you by a

friend and you would like to subscribe to the McAfee.com

Dispatch, click here.

-> http://dispatch.mcafee.com/sub.asp?s=22

Unsubscribe: If you do not want to receive the McAfee.com

Dispatch in the future, click here.

-> http://dispatch.mcafee.com/unsub.asp

This Virus Alert has been issued by the McAfee Anti-Virus

Emergency Response Team (AVERT).

Click here to view our permission marketing policy.

-> http://dispatch.mcafee.com/permission_policy.asp

------_=_NextPart_001_01BFDAD1.72A0BCE0

Content-Type: text/html;
charset=iso-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>VIRUS ALERT!</TITLE>

<META content="MSHTML 5.00.2314.1000" name=GENERATOR></HEAD>
<BODY>

<DIV>

<P><FONT face="Bookman Old Style" size=2>(((((((((((((((((( McAfee.com Dispatch 
)))))))))))))))))))))</FONT></P>
<P><FONT face="Bookman Old Style" size=2>_______________________VIRUS 
ALERT__________________________</FONT></P>

[This message is brought to you as a subscriber to the 
McAfee.com Dispatch. To unsubscribe, please follow the 
instructions at the bottom of the page.]
 
******* VIRUS ALERT - IRC/Stages.worm ********

<P></P>
<P><FONT face="Bookman Old Style" size=2>Dear McAfee.com Dispatch Subscriber: 
</FONT></P>
<P><FONT face="Bookman Old Style" size=2>IRC/Stages.worm is an Internet worm

that began spreading 
rapidly on 6/19. McAfee AVERT has assessed it as a HIGH-RISK 
threat. McAfee.com Clinic users who used VirusScan Online 
after 6/16 have protection against this worm. The worm uses 
Microsoft Outlook to send copies of itself to all entries in 
the address book and through installations of Pirch, ICQ and mIRC.* It also spreads to all available mapped drives on 
your system. This worm will arrive in an email message with this format: 
SUBJECT: "Funny", "Jokes", or "Life Stages", sometimes

<P><FONT face="Bookman Old Style" size=2>followed by "Text"</FONT></P>
<P></P>
<P><FONT face="Bookman Old Style" size=2>CONTENT: "The male and female stages of

life" 
ATTACHMENT: "LIFE_STAGES.TXT.SHS"

<P><FONT face="Bookman Old Style" size=2>(the suffix ".SHS" may be hidden) 
</FONT></P>
<P><FONT face="Bookman Old Style" size=2>If the attachment is run, the user sees

a list of jokes 
while the worm infects the system and attempts to send 
copies of itself to all addresses in Outlook address book, 
as well as through the other channels mentioned above.

* Pirch is an internet relay chat client for Microsoft 
Windows 95/98/NT, mIRC is a shareware IRC chat client for 
Windows and ICQ lets you initiate IRC style chat sessions - 
it alerts you when your friends are online and lets you chat

<P><FONT face="Bookman Old Style" size=2>with them.</FONT></P>
<P>&nbsp;</P>
<P><FONT face="Bookman Old Style" size=2>--McAfee.com </FONT></P>
<P>&nbsp;</P>
<P><FONT face="Bookman Old Style" size=2>_______________________Virus 
Fixes__________________________</FONT></P>

Find out more about this virus. Click here to go to the

<P><FONT face="Bookman Old Style" size=2>IRC/Stages.worm Help Center. 
</FONT></P>
<P><FONT face="Bookman Old Style" size=2>-&gt;

http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1585 Become a McAfee.com Clinic subscriber and check your system 
online. To use VirusScan Online, click here. 
-> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1586 Purchase the latest copy of VirusScan, please click here. 
-> http://store.mcafee.com/category.asp?CatID=3&CategoryLevel=1&rfr=VSCALRT Upgrade to the latest VirusScan. Purchase the VirusScan 
Maintenance Plan which entitles you to 12 months of upgrades, 
click here. -> http://store.mcafee.com/category.asp?CatID=18&CategoryLevel=1&rfr=VRSPLN Download the latest DAT files, click here. 
-> http://download.mcafee.com/updates/updates.asp

<P><FONT face="Bookman Old Style" size=2>____________________Clinic 
Subscribers______________________</FONT></P>

<P><FONT face="Bookman Old Style" size=2>If you are an ActiveShield user, get 
the latest update. Click here.</FONT></P>
<P><FONT face="Bookman Old Style" size=2>-&gt;

http://clinic.mcafee.com/clinic/virusscan/activeshield/start.asp  
Surf the Web safely. Get McAfee.com Personal Firewall. 
Click here. -> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=1458  
<FONT face="Bookman Old Style"

size=2>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ </FONT></P>

Subscribe: If this message has been passed on to you by a 
friend and you would like to subscribe to the McAfee.com 
Dispatch, click here. -> http://dispatch.mcafee.com/sub.asp?s=22 Unsubscribe: If you do not want to receive the McAfee.com

<P><FONT face="Bookman Old Style" size=2>Dispatch in the future, click here. 
</FONT></P>
<P><FONT face="Bookman Old Style" size=2>-&gt;

http://dispatch.mcafee.com/unsub.asp This Virus Alert has been issued by the McAfee Anti-Virus

<P><FONT face="Bookman Old Style" size=2>Emergency Response Team (AVERT). 
</FONT></P>
<P><FONT face="Bookman Old Style" size=2>Click here to view our permission

marketing policy. 
-> http://dispatch.mcafee.com/permission_policy.asp<FONT Received on Tue Jun 20 2000 - 11:06:08 CDT