VIRUS logo
1999/03/14
Yellow Internet Slovenia

 

Happy99

W32/ExploreZip.worm

W95.CIH (Chernobyl)

Removing the Happy99 Virus - WARNING - Please read this e-mail to remove the happy99 virus that you may have

NAVODILO ZA ODSTRANITEV VIRUSA happy99 IZ WIN

Nasvet: ce dobite e-mail v katerem je attachan fajl z imenom happy99, nikar ga ne zazenite, temvec delete mail!
LP, Jani
p.s. To sporocilo/navodilo sem dobil kot je in ga objavljam kot je, vsa odgovornost pri rabi le-tega je na vas samih.


Subject:
             [Fwd: happy99]
        Date:
             Sun, 14 Mar 1999 19:11:40 +0000
       From:
             Nicolas
 Organization:
         To: 
Please read this e-mail to remove the happy99 virus that you may have
installed
     Subject:
             Re: happy99
        Date:
             Sun, 14 Mar 1999 16:38:19 +0000
       From: 
 Organization: 
         To: 
  References:
             1

The Happy99 virus/worm/trojan is attached to newsgroup and e-mail messages as an attachment called Happy99.exe. 
You cannot get infected with this virus just by reading a newsgroup or e-mail message.
You have to execute the attachment.  Almost always, the person who sent it does not know that they are sending it out. It does not show up in their Outbox.
If you didn't execute the attachment, you can just delete it and move on.  If you execute an infected attachment, it will display a firework display. 
This virus does not affect Macs, DOS, Windows 3.x, OS/2, Linux or WebTV.

If you have already run Happy99.exe, to get rid of it, print out this page and follow the instructions.  I have tried to make it as simple as possible so that even if you are computer illiterate, you can safely clean your system of the virus.
However, please follow these steps carefully and in order.  Some of the steps are optional and are so indicated.

                         ***** WARNING *****

Failure to follow instructions EXACTLY may cause problems in accessing the internet or email from your computer!  I make or imply no guarantees.  If you choose to use the information here, it is of your own free will.  You are solely responsible for the care of your computer.  If you do not feel comfortable with your level of knowledge, or your ability to accurately follow these procedures, contact a local computer technician.  For further information about the virus, check out  Happy99 and Win32/Ska virus spreads via
internet .
 

1)   If you have not already done so since running the Happy99 program, restart your computer.

2)   *OPTIONAL* Delete all messages in your email program with the Happy99.exe attachment.

3)   Make SURE all internet related programs are disabled (this includes instant messaging services such as ICQ and AOL Instant Message), then restart your computer in MS-DOS mode (Click on the Start button, select "shut down", then select
"restart the computer
      in MS-DOS mode").

4)   Once it has restarted, you should see "C:\WINDOWS>" on the screen.

5)   Type in "cd system" and press "enter" or "return".  You should
       see "C:\WINDOWS\SYSTEM>" on the screen.  If that doesn't get you there, try
       "cd c:\windows\system" or "cd windows\system".

6)   Type in "attrib -r wsock32.dll" and press "enter" or "return".

7)   Type in "copy wsock32.ska wsock32.dll" and press "enter" or "return".

8)    When asked if you want to overwrite wsock32.dll, type "y" for yes.
       If you get an error message, type "del wsock32.dll" , press "enter" or "return"
and do step 7 again.

 9)   Type "del ska.dll", press "enter" or "return".

10)  Type "del ska.exe", press "enter" or "return".

11)  Type "del liste.ska", press "enter" or "return".

12)   *OPTIONAL* If you have followed all of the steps correctly, you may delete
"wsock32.ska"
        safely (Type "del wsock32.ska" and "enter" or "return").  I would suggest
renaming it so
        that you can keep it without it being detected by an antivirus program.  To
rename it type
        "ren wsock32.ska wsock32.old", then "enter" or "return".

13)   Type in "exit" and press "enter" or "return".

14)   I suggest that you notify everyone on your email list about the virus since you
may have sent
        it to them unknowingly.
 

That should take care of the Happy99 virus.  HOWEVER - unless you are running antivirus software with an updated data file, you could easily catch this virus again or another one.  If you already have the software, you should update your data files at least monthly.  If you do not have antivirus software, I suggest that you go to www.m...**   and download the FREE evaluation version of their software.  Be sure to also download all updated data files,
including the one for the Happy99 virus.  Just follow the  nstructions to install and update the program.  You can contact their customer service if you have problems with this.  M** program is considered to be one of the best.  And the updates are free!  Just be sure that you use SOME program.  Surfing
the internet without antivirus software is like having sex without protection.  The next virus you catch might be deadly to your computer.

www.m...** , M**  (da ne bo reklame, ce mi pisete vam posljem naslov)
e-mail: virus@jasico.si
Yellow Internet Slovenia
virus@jasico.si