1. /
  2. Security Response/
  3. VBS.Stages.A

VBS.Stages.A

Risk Level 2: Low

Discovered:
June 16, 2000
Updated:
February 13, 2007 11:59:32 AM
Also Known As:
Bloodhound.VBS.Worm, IRC/Stages.worm [McAfee], VBS/Stages.gen@MM [McAfee], Life_Stages Worm, I-Worm.Scrapworm [Kaspersky], VBS_STAGES.A [Trend], VBS/Stages-A [Sophos], VBS.Stages [Computer Associate
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Due to a decrease in submissions, this worm has been downgraded to a threat level 2 as of December 7, 2000.

This worm appears as an attachment named Life_stages.txt.shs. When you run the attachment it opens a text file in Notepad. The text file describes the male and female stages of life. While you are reading the text file, a script is running in the background. This worm spreads itself using Outlook, ICQ, mIRC, and PIRCH.

NOTE: An .shs file is a Microsoft Scrap Object file. These types of files are executable and can contain a wide variety of objects. The scrap object (.shs) extension does not appear in Windows Explorer even if all file extensions are displayed.

SARC suggests that corporate customers configure their email filtering systems to filter out or stop all incoming emails that have attachments with .shs extensions.


Antivirus Protection Dates

  • Initial Rapid Release version June 16, 2000
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version June 16, 2000
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date June 16, 2000
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 50 - 999
  • Number of Sites: More than 10
  • Geographical Distribution: High
  • Threat Containment: Easy
  • Removal: Difficult

Damage

  • Damage Level: Medium

Distribution

  • Distribution Level: High
Writeup By: Brian Ewell

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver