1. Symantec/
  2. Security Response/
  3. VBS.Stages.A


Risk Level 2: Low

June 16, 2000
February 13, 2007 11:59:32 AM
Also Known As:
Bloodhound.VBS.Worm, IRC/Stages.worm [McAfee], VBS/Stages.gen@MM [McAfee], Life_Stages Worm, I-Worm.Scrapworm [Kaspersky], VBS_STAGES.A [Trend], VBS/Stages-A [Sophos], VBS.Stages [Computer Associate
Systems Affected:

Due to a decrease in submissions, this worm has been downgraded to a threat level 2 as of December 7, 2000.

This worm appears as an attachment named Life_stages.txt.shs. When you run the attachment it opens a text file in Notepad. The text file describes the male and female stages of life. While you are reading the text file, a script is running in the background. This worm spreads itself using Outlook, ICQ, mIRC, and PIRCH.

NOTE: An .shs file is a Microsoft Scrap Object file. These types of files are executable and can contain a wide variety of objects. The scrap object (.shs) extension does not appear in Windows Explorer even if all file extensions are displayed.

SARC suggests that corporate customers configure their email filtering systems to filter out or stop all incoming emails that have attachments with .shs extensions.

Antivirus Protection Dates

  • Initial Rapid Release version June 16, 2000
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version June 16, 2000
  • Latest Daily Certified version September 28, 2010 revision 036
  • Initial Weekly Certified release date June 16, 2000
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Brian Ewell

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube