The VBS Stage Virus

June 21, '00

There are increasing reports of yet another macro virus known as the 'VBS Stage' virus circulating on the Internet, transmitted via an email attachment.

As with other recent VBS worms, it affects Windows users and spreads by sending an email to all addresses in your Outlook address book.

The following information comes from the Symantec site. The website address is below and will provide further information.

The email Subject: line may be any of 12 variants, and may or may not include "Fw:"--regardless, one of the following will be included:

• Life stages
• Funny
• Jokes

The email includes an attachment named Life_stages.txt.shs. An .shs file is a Microsoft Scrap Object file. The .shs extension does not appear in Windows Explorer even if all file extensions are displayed.

When you run the attachment it will open a text file in Notepad. The text file describes the male and female stages of life. While you are reading the text file, a script is running in the background.

When executed,

• files are added to the \Windows\System folder
• a Registry key is modified
• The Life_Stages.txt.shs file is added to the \Windows folder
• randomly named files are added to several locations:
  • root directory of all mapped drives
  • My Documents folder
  • Windows\Start Menu\Programs folder
• several hidden files are added to the RecycleBin, which cause the virus to spread when ICQ, mIRC, & PIRCH are run.

Information on identifying and removing this virus, as well as preventing infection by it, may be found at the usual anti-virus sites, including:

• Symantec, has a link to detailed removal procedures.
• Mcafee, which also has an instant, online scan option to check your machine.
• http://www.cert.org/advisories/

Information on the viruses which we are currently filtering can be found on our Virus Filters page: http://www.sover.net/notices/archived/3-23-00-virus.html