Re: [LI] WARNING

[Dhiran Rajbhandari <dhiren@xxxxxxxxxxxxx>]

The happy99.exe is a email worm which sluggish the email communication and
gives unusual load to mail server. When one opens this file, it modifies
the wsock32.dll and keeps the original file as wsock32.ska. If it can't
rename the file than it itself register into registry database somewhere in
Hkey_local_machine as ska.exe. And in next reboot it just modifies the
wsock file and release from registry. Then it sends a copy of happy99.exe
(file size 10 Kb) to every new user via email when one tries to send email.
It also manages the user list in liste.ska so that the same file is not
sent to same user. To remove this virus simply boot in DOS mode. Search for
the wsock32.ska, if found rename your infected wsock32.dll to wsock32.vir
and rename wsock32.ska to wsock32.dll. Also search for the liste.ska to
view the list of userlist to whom this file is sent. Now reboot your
computer and run reedit, search for the ska.exe or happy99.exe. If there is
any delete that. Your system will be free from Happy99 virus.


Regards,
Dhiren
At 12:18 PM 11/15/99 +0530, you wrote:
>
>
>Sudhir Gandotra wrote:
>> 
>>                   Name: Happy99.exe
>>    Happy99.exe    Type: unspecified type (application/octet-stream)
>>               Encoding: x-uuencode
>
>
>Dear Fellows,
>Please pay attention. Sudhir's PC is already affected by happy99 virus.
>This virus does a lot of cloning and keeps sending itself to the people
>who's name one might have in the addressbook.
>You would have received the attachment happy99.exe. Do not open it.
>It will rename some .dll to .srk or .slk...
>
>Reboot your machine and do this..
>Find these out.
>Delete the happy99.exe and restore those srk/slk files to .dll files.
>Overwrite the bakwaas .dll
>
>Bliss. You will hopefully get rid of the virus..
>
>All the best.. And all be HAPPY [pun intended]
>
>
>--------------------------------------------------------------------
>The Linux India Mailing List Archives are now available.  Please search
>the archive at http://lists.linux-india.org/ before posting your question
>to avoid repetition and save bandwidth.
> 
Dhiran Rajbhandari			
ATC Communications Network	
7/28 Adarsh Nagar, Birgunj Nepal
Ph. No.:- 051-24075		
"All man die, but matter how you die."
--------------------------------------------------------------------
The Linux India Mailing List Archives are now available.  Please search
the archive at http://lists.linux-india.org/ before posting your question
to avoid repetition and save bandwidth.