VBS.Stages is a rapidly spreading email worm through MS-Outlook, MIRC and Pirch networks. The infected mail comes with an attachment LIFE_STAGES.TXT.SHS - a scrap file. Opening the attachment launches the worm. It creates a file SCANREG.VBS under the windows system directory and modifies registry at the following location:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\RunServices\

It transfers the original REGEDIT.EXE file to the recylebin and renames it as REGEDIT.VXD. It also changes this file attribute as hidden. After this worm creates a file SOUND32B.DLL, which is a supplimentary file in order to spread istelf through the IRC channels. The Worm also creates files with random names on all available drives.

C:\WINDOWS\SYSTEM\SCANREG.VBS
C:\WINDOWS\SYSTEM\VBASET.OLB
C:\WINDOWS\SYSTEM\MSINFO16.TLB
C:\RECYCLED\DBINDEX.VBS
C:\RECYCLED\RCYCLDBN.DAT
C:\RECYCLED\MSRCYCLD.DAT

The worm sends mails with the infected file as an attachment to the addresses found in the address book
of MS-Outlook. The worm is capable of using any of the above mentioned applications at the same time.

VBS.Stages.A first appeared in June 2000.

Other names of  VBS.Stages.A:

This trojan is also known as VBS.Stages.A, MIRC.Stages.A.

Removing VBS.Stages.A from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.