Re: Another new worm???

[BlueBoar () THIEVCO COM (Blue Boar)]

This copy was provided to the SecurityFocus folks today by Ron Greer.
Password is "worm", without the quotes.

It appears to be a known virus/worm:

http://vil.mcafee.com/dispVirus.asp?virus_k=98668

They're (McAfee) saying they got word on 5/30, and the deal is that it
seems to have gotten loose today.

Also:

http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VName=VBS_STAGES.A

It looks like it's got a Word header on it (which seems strange to me
for a .shs extension) and it's partially obscufucated.  I'd be interested
in seeing some analysis.

                                        BB

<HR NOSHADE>
<UL>
<LI>application/x-unknown-content-type-WinZip attachment: stages.zip
</UL>