Syndicate: Re: Red Cross mission_happy99 virus

[Thomas Munz <tm@werkleitz.de>]

dear all,

Iaroslava has sent us the happy99.exe virus which she does not even know
that she has. 
if the happy99.exe-file has been opened already, this (see bottom)
apparently helps to solve it.

Thomas

helpdesk wrote:

> Dear Valued Customer,
>
> It has come to our attention that a file named HAPPY99.EXE is being
> distributed via email that affects Windows 95, Windows 98, and Windows NT.
> If you receive this file, DO NOT CLICK OR RUN IT.  Delete it immediately.
>
> When you click or run HAPPY99.EXE, it installs files and modifies
> settings on your Operating System.  HAPPY99.EXE then attaches itself to
> all emails that you send thus possibly affecting your contacts' computers.
>
> We searched for what to do in case you have HAPPY99.EXE.
>
> Step One...
> Look for the following files (usually in Windows\System):
>
> (1) ska.exe
> (2) ska.dll
> (3) wsock32.ska
>



> If you don't find it, then your PC is OK.  If you find it, proceed to Step
> Two.
>
> Step Two...
> Delete ska.exe and ska.dll.
>
> Step Three...
> Rename wsock32.ska to wsock32.dll.  (wsock32.ska is actually your
> original wsock32.dll that HAPPY99.EXE renamed.)
>
> Step Four...
> Click Start then click Run.  Type REGEDIT.  This launches the registry
> Editor.
>
> Step Five...
> In the Registry Editor, click Edit the click Find.  Type RunOnce.  The
> right portion of the Registry Editor is split into Name & Data.  Look for
> the file named ska.exe under the Name column.
>
> If you do not find this file, then you are OK already.  If you do,
> proceed to Step Six:
>
> Step Six...
> Click on ska.exe then delete all contents of the box named Value Data. Do
> not delete the file ska.exe itself as you risk damaging your operating
> system.
>
> When you've done all these, you're OK!