New Computer E-Mail Virus Cloaks Itself as a Text File

A new computer virus, which looks like a harmless text file, has caused shutdowns of the e-mail systems at four Fortune 100 companies, antivirus experts said Monday.

The virus does no harm to computer files, but similar to May’s “Love Bug” virus, simply multiplies by sending itself out to everyone listed in the infected computer’s address book.

While users are warned about VisualBasic attachments, which appear with “.vbs” extensions, the so-called “Stages” virus looks like a text file, complete with a “.txt” extension. But the real extension is “.shs,” which stands for Windows Shell Scrap Object. A Scrap file can contain anything, including executable and malicious code.

The “.shs” extension does not appear even if a user sets Windows to show all file extensions. Microsoft designed this extension to be invisible, and it cannot be changed without entering the operating system’s most fragile configuration systems.

The virus hit companies in the United States by Friday and began appearing in Australia and Asia over the weekend, said David Perry of Trend Micro Inc., a maker of antivirus software.

Since then, makers of the popular McAfee antivirus program have reclassified “Stages” as a larger threat, and said more than 100 of their customers--many major companies and almost all based in the United States--reported infections. One company had more than 5,000 individual users infected.

“Due to the infection rate, we’re moving it to ‘high risk,’ ” said Sal Viveros, a spokesman for McAfee.

Viveros said an analysis of the virus showed that it was signed by someone named “Zulu.”