There is an class of viruses that disguise themselves using Win9x and NT’s .shs
extension. The file looks like a normal txt file, as in normal.txt.shs. This extension remains hidden even when NT has
been configured to display hidden and system
files. The .shs extension is hidden if there is a value NeverShowExt under the [HKEY_CLASSES_ROOT] key. Be careful.
Backup the key and then delete the value. It is usually found under the
[HKEY_CLASSES_ROOT\ShellScrap] key but it could be in another location. It may
not exist.
