The VBS.Stages virus is a worm that spreads via email attachment, by sending infected email messages from computers it has infected. It is very similar to the I Love Your, Sillyworm, and PrettyPark virus. This email worm is written in the "Visual Basic Script" (VBS) scripting language. What makes this file different, however, is the fact that it does not have the VBS file extension.
How VBS.Stages Does its Dirty Work
The VBS.Stages virus worm is spread via an email attachment that is called: "life_stages.txt.shs" It uses Outlook, mIRC, ICQ, and PIRCH to spread itself.
When the life_stages.txt.shs attachment is opened, it opens a Notepad text file. In this text file, it displays a "joke" outlining the various stages of life for males and females. However, as you read this seemingly benign message, the worm will run a malicious script in the background. It will install itself into the computer system and copy itself to network drives.
Once it installs itself on a computer, the VBS.Stages worm appears as a scrap object created in Windows by dragging data from a particular program to the desktop. Doing this creates a scrap file with the .SHS extension.
Most computers will not show the .SHS file extension even if the system is set to show all extensions. This usually fools unsuspecting users into thinking that it’s a harmless text file instead a dangerous malicious worm. The user can see the file extension by right-clicking on the file and then clicking on "Properties."
VBS.Stages worm will then access the Outlook address book and select random email addresses from the contact list. It will then send mass email to these addresses with the life_stages.txt.shs attachment. This email worm will randomly generate the subject of this email. Typically, this subject will start with "Fw:" or "text" and include one of the phrases:
- Funny
- Life stages
- Jokes
These emails will appear to have come from a legitimate user, making it more likely that the recipient will open the email and click on the attachment. Once the emails are sent out, VBS.Stages worm will delete copies of these email messages, leaving no trace of its presence. It will also make several modifications to the computer system
VBS.Stages also drops files that ensure it will be re-activated every time Windows is booted up or ICQ launched. The two files are:
- SCANREG.VBS - in the Windows system directory:
- DBINDEX.VBS - in the Windows directory
Uninstalling the VBS.Stages Worm
Here are two programs designed to remove the VBS.Stages worm from infected computers:
