SHS File Documentation

---

Technical details

Feature	Value
Full name	Shell Scrap Object File
File extension	.shs
MIME type	application/octet-stream
Format type	OLE2 “scrap” object, binary
Container / base format	OLE2 / Compound File Binary (same container as legacy .doc, .xls)
Developer	Microsoft
Introduced	Windows 95 (1995)
Status	Obsolete — shell-scrap handling disabled by default since Windows XP SP2 (2004)
Handler component	shscrap.dll (unregistered on modern Windows)
Created by	Dragging a selection from Word/Excel onto the Windows desktop or a folder
Byte order	Little-endian (CFB structures)
Magic number (hex)	D0 CF 11 E0 A1 B1 1A E1
Extension visibility	Historically force-hidden by the shell, even with “show extensions” on
Security risk	High — can execute embedded OLE verbs; used by the 2000-era Stages worm
Open standard	No
Related extensions	.doc, .xls, .ole, .scf
Specification	learn.microsoft.com/openspecs/windows_protocols/ms-cfb/

What is an SHS file?

SHS stands for Shell Scrap Object, a document fragment format Microsoft introduced with Windows 95 in 1995. On Windows 95, 98 and Me, selecting text in Microsoft Word or a range of cells in Excel and dragging that selection onto the desktop (or into a folder) produced a “scrap”: a small file with the .shs extension that held the dragged content as an embedded OLE object. Double-clicking the scrap re-inserted the fragment into a document. The whole mechanism was part of OLE drag-and-drop and was implemented by a single shell component, shscrap.dll.

The format is effectively dead. Microsoft stopped registering shscrap.dll by default from Windows XP Service Pack 2 (2004), and Windows 10 and 11 have no built-in way to create or open an .shs. The reason was security: the scrap format could carry and silently run executable OLE verbs, and the Windows shell always hid the .shs suffix, which made it an ideal disguise for malware. Almost everything technically interesting about the format follows from those two facts, so this page describes how the file is actually built and why it was abused.

The OLE2 compound file container

A scrap is not a bespoke binary layout. It is a Microsoft OLE2 Compound File Binary (CFB), the same “file system inside a file” container that stored legacy DOC, XLS and PUB documents. Every CFB begins with the 8-byte signature D0 CF 11 E0 A1 B1 1A E1 at offset 0, followed by a header that describes a set of internal sectors organised into storages (directories) and streams (files).

Offset  Size  Field
0x00    8     Signature: D0 CF 11 E0 A1 B1 1A E1
0x18    2     Minor version
0x1A    2     Major version (0x0003 = 512-byte sectors, 0x0004 = 4096)
0x1C    2     Byte order mark (FE FF = little-endian)
0x1E    2     Sector shift (0x0009 -> 512-byte sectors)
0x2C    4     Number of FAT sectors
0x30    4     First directory sector location
0x3C    4     First mini-FAT sector location
0x44    4     First DIFAT sector location

Because the container is generic, the header alone cannot tell you whether a compound file is a Word document, a spreadsheet or a scrap. All CFB structures are little-endian. Identification comes from walking the directory and reading the names of the storages and streams inside, which is also how a forensic viewer inspects a suspicious .shs without ever asking the shell to act on it.

Scrap streams and the OLE verb

Inside the compound file, a scrap holds the embedded object and the metadata the shell needs to reconstitute it. The important pieces are the object’s class identifier (CLSID), which names the application that owns the content (for example Word or Excel), and the OLE verb, the action the shell performs on the object. A verb of “Edit” or “Open” re-inserts a text or cell fragment; but the verb is just an instruction to an OLE server, and an object can name a server and a command that do something entirely different.

Root Entry (storage, CLSID identifies the scrap/OLE server)
 ├─ \x01Ole            OLE stream: object flags and state
 ├─ \x01CompObj        class name and user type of the embedded object
 ├─ ObjInfo            scrap object information
 └─ (object streams)   the embedded content or command to run

When you double-clicked a scrap on a legacy system, the shell read the CLSID, loaded the matching OLE server, and executed the stored verb, all without prompting. For a genuine Word scrap this simply reopened a snippet of text. But nothing in the format constrained the object to be inert data. A scrap could embed a command-line or scripting object and a verb that ran it, so opening the file executed code with the user’s privileges.

The hidden-extension attack and the Stages worm

The scrap format’s fatal flaw was not just that it could run code, but that the shell always hid the .shs suffix, even when “Hide extensions for known file types” was turned off. A file named PHOTO.JPG.shs displayed in Explorer and in mail clients as PHOTO.JPG, with an icon that could be set to look like an image. A user who believed they were opening a picture instead triggered the embedded verb.

This is the exact mechanism behind VBS/Stages (the “Life Stages” worm) in June 2000. It spread as an attachment called something like LIFE_STAGES.TXT.SHS, which looked like a harmless text file. Opening it ran embedded script that copied the worm and mailed it onward. Because the disguise worked at the shell level rather than in any one mail client, no amount of user caution about “.exe attachments” helped, and the format earned a permanent place on antivirus block lists. Microsoft’s response was to unregister the scrap handler, which is why modern Windows does nothing at all when you double-click an .shs.

Inspecting a scrap safely without executing it

If you have a genuine old scrap (for example on an archived Windows 98 drive) and want the content out, the safe path is to read the compound file’s streams rather than let the shell act on the object. Because a .shs is a standard OLE2 container, tools that understand that container can list and extract its streams as passive data. 7-Zip can open the compound file and show its internal entries; a structured-storage viewer such as MiTeC’s can browse the storages and export the text stream. Neither invokes the OLE verb, so neither runs any embedded command.

The rule that follows from the format’s design is simple: never double-click or “run” an .shs, and treat any that arrives by email or download as hostile until proven otherwise. If you must examine one, do it on an isolated virtual machine and only inspect the streams. Recovering legitimate content means either extracting the text stream with a viewer, or, on a Windows 9x/2000 virtual machine with a file you know is safe, re-inserting the scrap into Word or Excel and saving it as a normal document.

Frequently asked questions

Is an SHS file always a virus?

No. The format was a legitimate Windows 95/98 convenience feature, and a scrap created by dragging text out of Word is harmless data. The danger is structural: the format can embed and run an OLE verb, and the shell hid the extension, so it was heavily abused. An unexpected .shs, especially by email, should be treated as malicious.

Why did Windows hide the .shs extension?

Shell Scrap was registered with the NeverShowExt attribute, a shell flag that forces an extension to stay hidden regardless of Explorer’s settings. That was cosmetic for a legitimate scrap but became a security hole, because a double extension like .jpg.shs showed only the fake .jpg part.

Why does nothing happen when I open an SHS on Windows 10 or 11?

The shscrap.dll handler is not registered on any Windows since XP SP2, so the shell has no verb to run and no way to recreate the object. There is no supported way to restore the handler; inspect the file with an OLE viewer instead.

References

• Microsoft — [MS-CFB] Compound File Binary File Format
• MiTeC — Structured Storage Viewer (inspect OLE compound files)
• CISA — security alerts and historical malware advisories

Feedback

Was this page helpful?

Yes No

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.