Email Virus warning

[krusty the klown]

Another 'Love Bug' stule virus - an email attachment "LIFE_STAGES.TXT.SHS"
will start emailing itself to contacts in your address book.

As a general rule, anything with the file extension .vbs or .shs is likely
to be up to no good!

The story:
http://www.vnunet.com/News/1103625

Info and removal details:
http://www.symantec.com/avcenter/venc/data/vbs.stages.a.html

Don't get infected!

[ctaylor]

According to the National Infrastructure Protection Center
http://www.nipc.gov/assess00-048.htm

these SHS extentions will nto be visible even if your Windows settings are set to show all extentions. Further the visible extention will be TXT and when opened you will be shown a TXT file, so you won't even know something odd has happened until it is too late

[This message has been edited by ctaylor (edited 06-20-2000).]

[Dave_H]

Thanks for the warning!
I also noticed that Norton has a new set of virus definitions out, and found this on there site if anyone needs it.
VBS.Stages.A Fix (http://www.symantec.com/avcenter/venc/data/fix.vbs.stages.html)
Dave

Edit- Sorry krusty http://sysopt.earthweb.com/forum/smile.gif I didn't see you already posted that. I'm pretty stupid in the mourning before my coffee. -edit


[This message has been edited by Dave_H (edited 06-20-2000).]

[Mntsnow]

Thanks for the Heads Up! Off to get the update http://sysopt.earthweb.com/forum/smile.gif

Mntsnow

[krusty the klown]

Ctaylor,

that's evil eh?? I created a small file in notepad, then saved it as untitled.shs on my desktop - it appeared as untitled and did not show the file extension, even though the option 'show all files' is checked and the option 'hide known file extensions' is unchecked on my PC.

The only way I could find out what the file extension is was to right-click and look at 'properties', where the DOS name showed the correct extension.

[jl123]

Ok so let's say i get it in an email. Do i delete it or how do i go about getting rid of it. I already downloaded the fixlife.exe file so i'm ok, it didn't detect it on my system. http://sysopt.earthweb.com/forum/smile.gif

edit* Oh yeah thanks for the warning. I appriciate it. http://sysopt.earthweb.com/forum/smile.gif

~Joel(jl123)

[This message has been edited by jl123 (edited 06-21-2000).]

[krusty the klown]

I think it's only the file extension that's not visible, but the actual filename is visible.

I think the virus (worm) only activates if you try and open it, so deleting the whole email (twice with outlook express!) should do the job.

[socalgal]

Article in 07.00 PCMag from

http://www.pc-help.org/security/scrap.htm

In part:

To make the extensions visible, remove the NeverShowExt values from these keys:
HKEY_CLASSES_ROOT\ShellScrap
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DocShortcut

If you have a virus scanner, add the .SHS and .SHB extensions to its list of program files. This way, as exploits surface, your scanner is more likely to spot them. McAfee and several others have a means to do this. The image at right shows how it looks if you're using McAfee 4.x.

If you're really paranoid, you can disable scrap objects by one or both of these means:
Alter or remove both file types in the File Types dialog. (Open an Explorer window, and select View... Options... and the File Types tab. Look for Shell Scrap Object and Shortcut to Document.)

To disable scrap files very thoroughly, remove or rename the shscrap.dll file in your System folder.

Search your hard drive(s) and see if you have any scrap object files hanging about. Who knows what might turn up?