Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

VBS/Stages.A

VBS/Stages.A is a worm written in the language Visual Basic Script (VBS).  It spreads by means of email which it sends to the first 100 addresses from the address book.  The subject of emails may be "Life stages", "Funny" or "Jokes".  Sometimes the virus adds to it the word "text".  The text of the email in most cases is "> The male and female stages of life."  Occasionally followed by the greeting "Bye.".  The worm adds itself to the email in the form of an attachment with the name LIFE_STAGES.TXT.SHS.  When a user clicks on this attachment Notepad with the following funny text is opened:

The male stages of life:

Age. Seduction lines.
17 My parents are away for the weekend.
25 My girlfriend is away for the weekend.
35 My fiancee is away for the weekend.
48 My wife is away for the weekend.
66 My second wife is dead.


Age. Favorite sport.
17 Sex.
25 Sex.
35 Sex.
48 Sex.
66 Napping.

Age. Definiton of a successful date.
17 Tongue.
25 Breakfast.
35 She didn't set back my therapy.
48 I didn't have to meet her kids.
66 Got home alive.

The female stages of life:

Age. Favourite fantasy.
17 Tall, dark and hansome.
25 Tall, dark and hansome with money.
35 Tall, dark and hansome with money and a brain.
48 A man with hair.
66 A man.

Age. Ideal date.
17 He offers to pay.
25 He pays.
35 He cooks breakfast next morning.
48 He cooks breakfast next morning for the kids.
66 He can chew his breakfast.

The worm writes as startup instruction in the system registry so that it gets executed as a service process when the system starts. ,It copies its body into the directories MyDocuments, Programs, System, Windows and Recycled under names LIFE_STAGES.TXT, MSINFO16.TLB, MSRCYCLD.DAT, SCANREG.VBS, RCYCLDBN.DAT, DBINDEX.VBS and VBASET.OLB.  Additionally it copies itself also to all accessible network disks.
Moreover the worm moves the file REGEDIT.EXE into directory RECYCLED and renames it to RECYCLED.VXD.
The worm is able to also spread with help of the programs MIRC32 and PIRCH98.  To make this possible it creates the file SOUND32B.DLL in the WINDOWS directory and the file EVENTS.INI in the program PIRCH98 directory, respectively.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.