Re: Another new worm???

[pierre () DATARESCUE COM (Pierre Vandevenne)]

On Mon, 19 Jun 2000 09:49:54 EDT, Studio1057 () AOL COM wrote:

> Hello all,
>
> This morning I am getting a lot of mail with attachments. Trends are:
> No from and to appears in the header
> Attachments have .SHS extension (??!!)
> the subject is either :Jokes", or "Funny: Jokes text", or "Life stages".
> Funny text does not show the attachment. The rest are .txt.shs extensions,
> the filename is the subject line but in all caps.
> Any ideas? I am planning to clip a copy of all the "variations" I'm getting
> to check out what is going on. Unless of course somebody else has already
> done so in which case I am anxiously awaiting what you guys cme up with.

You are infected by a VBS worm, known as stages or scrapworm.
Update your anti-virus or get one ;-)

c:\temp\met\life_stages.txt.shs
Infection: 'I-Worm.Scrapworm' [AVP]

http://www.sophos.com/virusinfo/analyses/vbsstagesa.html
http://www.f-secure.com/v-descs/stages.htm

---
http://www.datarescue.com/idabase/ida.htm
IDA Pro 4.1 - Yes, we have done it again !