[Date Prev][Date Next][Thread Prev][Thread Next] - [Date Index][Thread Index][Author Index]

Re: MSPE 2.00F *** DO NOT RUN HAPPY99.EXE ***



CAUTION!

The program HAPPY99.EXE that came from Roy's computer
with the same title as the announcement about MSPE 2.00F
is a "worm" program (like a virus).  Do not run this program!

If you have not run this program, just delete HAPPY99.EXE
and you'll be OK.

If you have already run the program, please follow the
procedure to remove the worm from your computer *BEFORE*
you send any more email.

Never believe the details of any email you get about a virus.
They are almost always wrong or leaving something out.
That includes this one!  Instead, check with a reliable virus
information web page.  Everything you need to know about
this worm is available (among other places) at
http://www.symantec.com/avcenter/venc/data/happy99.worm.html

For your convenience, I am copying the instructions from
that page here.  But if you follow my advice, you will check the
page yourself.

I have programmed the mailing list server to reject most
discussion on this subject, since this kind of thing can lead
to a major "storm" of off-topic discussion.  I hope this is the
last time you'll hear about this worm on the mailing list.

73  -Paul
kb5mu@amsat.org

Removing the worm manually:

1.delete WINDOWS\SYSTEM\SKA.EXE 
2.delete WINDOWS\SYSTEM\SKA.DLL 
3.in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK 
4.in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL 
5.delete the downloaded file, usually named HAPPY99.EXE 

Windows prevents you to do step #3 and #4 above if the machine is still connected to the Internet. The file "windows\system\wsock32.dll" is used whenever the machine is connected to Internet (i.e. through dial-up or LAN connection).

If you are using dial-up connection (i.e. America Online), you need to do the following:

1.terminate internet connection 
2.delete WINDOWS\SYSTEM\SKA.EXE 
3.delete WINDOWS\SYSTEM\SKA.DLL 
4.in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK 
5.in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL 
6.delete the downloaded file, usually named HAPPY99.EXE 


If you are connected to Internet through LAN (i.e. in the office or cable modem), you need to do the following:

1.From the Start menu, select shutdown-restart in MS DOS mode 
2.type CD \windows\system when DOS prompt (C:\)appears 
3.type RENAME WSOCK32.DLL WSOCK32.BAK 
4.type RENAME WSOCK32.SKA WSOCK32.DLL 
5.type DEL SKA.EXE 
6.type DEL SKA.DLL 

** end of partial quote from http://www.symantec.com/avcenter/venc/data/happy99.worm.html **



----
Via the amsat-bb mailing list at AMSAT.ORG courtesy of AMSAT-NA.
To unsubscribe, send "unsubscribe amsat-bb" to Majordomo@amsat.org



AMSAT Top AMSAT Home