As long as we're on this subject, let me ask a question. Since this virus is kind enough (?) to make a backup copy of the WSOCK32.DLL file, what would happen if you: (1) verified your machine was "clean" (no SKA.EXE, SKA.DLL, or WSOCK32.SKA files and the registry is OK) (2) made your own backup file by copying WSOCK32.DLL to WSOCK32.SKA? When the virus makes its backup copy, isn't it going to try to copy WSOCK32.DLL to WSOCK32.SKA? Since the WSOCK32.SKA already exists, wouldn't there be a message asking if you wanted to overwrite it? If this message ever suddenly popped up, you could pretty well figure the virus was loose, and could you not shut down right then and take remedial action without the virus ever getting loose? Maybe the virus is "smarter" than we think. I'll be anxious to hear comments on this. RGDS:EARL : 1.delete WINDOWS\SYSTEM\SKA.EXE 2.delete WINDOWS\SYSTEM\SKA.DLL 3.replace WINDOWS\SYSTEM\WSOCK32.DLL with WINDOWS\SYSTEM\WSOCK32.SKA 4.delete the downloaded file, usually named HAPPY99.EXE This is just one reminder that we sould NEVER download anything from anyone we don't know. Of course I know several person that received it from friends that didn't know they were sending it. The best thing is that you get a virus protection program and keep it up todate. Lisa Cleversey --