Symantec Provides Detection for Fast-Spreading VBS.Stages.A Polymorphic Computer Worm

CUPERTINO, Calif. - June 19, 2000 - Symantec Corporation (Nasdaq: SYMC), a leader in Internet security technology, today announced detection for VBS.Stages.A, a new and fast-spreading polymorphic computer worm.

Symantec's Anti-Virus Research Lab gives this worm a Category 4 rating, as it has potential to be difficult to contain, and cause severe damage. This worm appears as a .TXT file attachment titled LIFE_STAGES.TXT.SHS. that disguises an .SHS file. An .SHS file is a Microsoft Scrap Object file which are executable files that can contain a wide variety of objects. The scrap object (SHS) extension does not appear in Windows Explorer even if all file extensions are displayed.

When executed, the attachment will open a text file in the Notepad that describes the male and female stages of life. While the user is reading the text file, the script executes in the background, moving the REGEDIT.EXE file to the recycle bin as a hidden system file named RECYCLED.VXD. - resulting in modification of the SYSTEM REGISTRY and REGEDIT.EXE files that cause system instability.

VBS.Stages.A spreads itself like VBS.LOVELETTER.A, sending mail to a users' entire MS Outlook address book with a randomly generated subject line, which can overload mail servers. Additionally, the worm spreads itself via ICQ, mIRC and PIRCH and copies itself to mapped drives. The subject line may be one of 12 combinations and in some cases begins with "FW." The subject line will contain either "Life stages," "Funny" or "Jokes" or several combinations of these. This worm immediately deletes copies of the sent emails to ensure there is no record of its presence.

Symantec recommends that computer users do not attempt to open the attached document, and protect themselves by using Norton AntiVirus For Gateways to filter out all incoming emails that have attachments with .SHS extensions. New definition sets are now available to detect VBS.Stages.A and Norton AntiVirus users can download them through Symantec's LiveUpdate feature, or from the Symantec Web site at www.symantec.com/avcenter/download.html.

SARC, Symantec's AntiVirus Research Center, is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.

About Symantec
Symantec, a world leader in Internet security technology, provides content security solutions to enterprise organisations and helps companies manage and support workforces that use computers and other mobile devices.

Symantec's Canadian operations are headquartered in Toronto with offices in Montreal, Ottawa, and Vancouver. For more information on Symantec products or current promotions, contact the Canadian office at (416) 441-3676 or access Symantec's Canadian web-site at www.symantec.ca. Symantec is an active member of the Canadian Alliance Against Software Theft (CAAST).

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, please view the Symantec Press Centre on Symantec's web site.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders.