----- Original Message -----
From: Greg Roy <[log in to unmask]>
Subject: Re: [PCSOFT] Virus Info from Steve Gibson FYI


> "Believe it or not, EVEN IF we have Windows set to show file extensions --
> as we all probably do -- Windows STILL won't show an
> extension of ".shs", which is some thing called a "Shell Scrap Object"."
>
> Then why when I looked on my machine, I found .shs files in explorer.
> What do I have turned on that you don't?
~~~~~~~~~~~~~~~~~~~~~~~~~~
Greg,

Did you actually *see* the shs extension? I created a scrap object by
dragging some text from Word onto my desktop, but was unable to see the shs
extension on either my desktop, thru windows explorer, or using 'find'. The
file itself was visible in all three views, but not the extension -- ( I
have all extensions visible ). The shs extension was only visible when I
looked at the file's properties.
~~~~~~~~~~~~~~~~~~~~~~~~~~

> In fact, my personal system received the Life.stages virus via mIRC (must
be
> a variant off of the outlook one), but since I saw that it had the .shs
> extension I was able to delete it.

~~~~~~~~~~~~~~~~~~~~~~~
Again - did you see the extension without checking the file properties? What
mail program and OS are you using?
~~~~~~~~~~~~~~~~~~~~~~~

> Though I will be making that .dll change as well.

~~~~~~~~~~~~~~~~~~~~~~~
As an added note:

Steve Gibson's solution ( changing shscrap.dll  to  shscrap.dll.xxx ) does
seem to render any scrap objects useless, but it should be noted that it
also defeats the whole purpose of using scrap objects the way they were
intended. Also, using his test file ( test.txt.shs ) is a dangerous
endeavour for those unfamilar with changing file extensions. Just my humble
opinion.

Alan Thompson
~~~~~~~~~~~~~~~~~~~~~~~

                Curious about the people moderating your
                   messages? Visit our staff web site:
                     http://nospin.com/pc/staff.html