Biblical Hebrew Forum

["J. Raymond (Ray) Kelley" <jraykelley AT prodigy.net>]

some people never learn safe computing ... never, never, never open an 
"-.exe" file unless you
know and trust the sender, and even then only with an updated virus package 
working

as for the Happy99 worm it's annoying but, for all intents and purposes 
generally benign ...
however, if you've opened it, here's the way to clean your machine ...

Happy99.Worm
VirusName: Happy99.Worm
Aliases:  Trojan.Happy99, I-Worm.Happy
Likelihood:  Common
Region Reported:  US, Europe
Keys:  Trojan Horse, Worm

Description:
This is a worm program, NOT a virus. This program has reportedly been
received through email spamming and USENET newsgroup posting. The file is
usually named HAPPY99.EXE in the email or article attachment.  When being
executed, the program also opens a window entitled "Happy New Year 1999 !!"
showing a firework display to disguise its other actions. The program copies
itself as SKA.EXE and extracts a DLL that it carries as SKA.DLL into
WINDOWS\SYSTEM directory. It also modifies WSOCK32.DLL in WINDOWS\SYSTEM
directory and copies the original WSOCK32.DLL into WSOCK32.SKA. WSOCK32.DLL
handles internet-connectivity in Windows 95 and 98. The modification to
WSOCK32.DLL allows the worm routine to be triggered when a connect or send
activity is detected. When such online activity occurs, the modified code
loads the worm's SKA.DLL. This SKA.DLL creates a new email or a new article
with UUENCODED HAPPY99.EXE inserted into the email or article. It then sends
this email or posts this article.  If WSOCK32.DLL is in use when the worm
tries to modify it (i.e. a user is online), the worm adds a registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE
The registry entry loads the worm the next time Windows start.
Removing the worm manually:
1.delete WINDOWS\SYSTEM\SKA.EXE
2.delete WINDOWS\SYSTEM\SKA.DLL
3.replace WINDOWS\SYSTEM\WSOCK32.DLL with
WINDOWS\SYSTEM\WSOCK32.SKA
4.delete the downloaded file, usually named
HAPPY99.EXE
Safe Computing:
<end snip>



jharper AT ix.netcom.com wrote:

> On 03/11/99 22:13:04 you wrote:
> >
> >Sorry folks,
> >
> >This one is not a hoax. The Happy99.exe is a real virus. DO NOT open the
> >file. John Ronning just sent the virus to the list in an e-mail "2Ki 20:7
> >and Isa 38:21"
> >
> >If you did open it, you now have the virus on your computer.
>
> This is actually not quite accurate.  One has to execute the program for it 
> to activate.  The
> program then gives you a graphic to the screen that's pretty unmistakeable. 
>  If you don't know
> whether you activated it or not, you probably didn't.  You can also 
> navigate to the
> \WINDOWS\SYSTEM directory and check for files named ska.* -- you should 
> have an ska.dll if the
> worm has executed.
>
> Jane Harper
>
> ---------
> jharper AT ix.netcom.com
> Pacific School of Religion, Berkeley, CA
> Si hoc legere scis, nimium eruditionem habes.
>
> ---
> You are currently subscribed to b-hebrew as: jraykelley AT prodigy.net
> To unsubscribe, forward this message to $subst('Email.Unsub')
> To subscribe, send an email to join-b-hebrew AT franklin.oit.unc.edu.