What are ShellScrap viruses?

ShellScrap viruses are a form of virus that are contained in files ending with the extension .SHS.

A current well-known virus of this type is the life stages worm.

This worm will arrive in an email message with this format:
Subject: "Funny", "Jokes", or "Life Stages", sometimes followed by "Text"
Content: "The male and female stages of life"
Attachment: "LIFE_STAGES.TXT.SHS" (the suffix ".SHS" is usually hidden to most users)

 What makes this type of Virus extremely dangerous is that for most users (unless corrective measures are taken) the .SHS extension remains hidden. Thus an infected file named jokes.txt.shs will appear as simply jokes.txt with the .SHS hidden. Most users would assume that this file is safe to open since .txt files are normally incapable of spreading Viruses. When the file is opened the scrip is executed and the virus is unknowingly spread.

Test you vulnerability

Download the 3 asci files below to your computer by right clicking on each, and choosing save target as:

testexe.txt.exe    testvbs.txt.vbs    testshs.txt.shs

Did the names Change ? Are you still able to see the extensions on your computer?

If you can't see the .exe you need to go to your folder options and select the view tab. Remove the check from the item that says hide all extensions for registered file types.(click here for a picture)You should now see all the extensions except the .shs extension. This is because some brilliant person at Microsoft decided this Very Dangerous file type should stay hidden no matter what setting you choose.To solve this problem you can edit you registry yourself, or Download and run my "Don't hide my ShellScrap!.inf" Program.

Warning! always back up your registry before making changes!

To edit the registry yourself run regedit, do a search for ShellScrap and change the setting that says ShellScrap NeverShowExt to - ShellScrap AllwaysShowExt. This is usually the second entry you find.

If you are uncomfortable editing you registry you may wish to download my program to do it for you.

Click here to Download My "Don't hide my ShellScrap!.inf" Program

Instructions for Use

Download to your desktop

Right click on the "Don't Hide my ShellScrap!.inf" file (You right click with the right button NOT the left!)

Select Install

Reboot

Look at the 3 test files. You should now be able to see the .shs ShellScrap extension.

And now for the important part. Now that you can see the .SHS extension, if you receive any e-mail with a .SHS attachment ...

DON'T OPEN IT!

Another impotent step is to make sure that your virus scanner is current AND SET TO SCAN FOR .SHS AND OTHER DANGEROUS FILE TYPES. If you do not know what type of files are dangerous then please go here to:Dave's Common Sense Virus Info Page or set your scanner to SCAN ALL FILES.

Remember, no Anti-Virus Software no matter how sophisticated can make up for an ignorant and careless user.

For more info on The life stages virus go here:

http://vil.mcafee.com/dispVirus.asp?virus_k=98668

http://www.datafellows.com/v-descs/stages.htm

http://www.norton.com/avcenter/venc/data/vbs.stages.a.html