Help: lifestages.txt.shs

What does it do?

• The following files are created in the Windows\System folder:
  • scanreg.vbs - this writes to the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
  • vbaset.olb
  • msinfo16.tlb
• The following files are created in the Recycle Bin:
  • recycled.vxd - recycled.exe is moved to this name
  • msrcycld.dat - copy of the original .shs file.
  • rcycldbn.dat - copy of the Scanreg.vbs file.
  • dbindex.vbs - set to be run when ICQ is run.

Manual Removal

• Click Start-Find, and then click Files or Folders
  ( Search ALL drives )
  Click New Search.
  Find And Delete:
  • scanreg.vbs
  • vbaset.olb
  • msinfo16.tlb
  Find And Delete In Recycle Bin:
  • dbindex.vbs
  • msrcycld.dat
  • rcycldbn.dat
• Click Start, Programs, and then MS-DOS Prompt.
  Type the following inside the window:
  • c:
  • cd \
  • cd recycled
  • attrib -h -s -r *.*
  • copy recycled.vxd c:\windows\regedit.exe
  • del recycled.vxd
  • del msrcycld.dat
  • del rcycldbn.dat
  • del dbindex.vbs
  • exit
• Restore the association of .reg files
  HKEY_CLASSES_ROOT\regfile\DefaultIcon\(Default)
  "C:\Windows\regedit.exe,1"
  HKEY_CLASSES_ROOT\regfile\shell\open\command = "regedit.exe %1"
  Remove the autostart registry entry
  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\ScanReg

A file fix is available for this virus. Before downloading, please read our disclaimer on all software downloadable from this site. Download it here.