I have just been informed that a program attached to an e-mail I received yesterday had a virus attached to it. Fortunately, it's not the type of virus that eats your hard drive. What it does, however, it attach itself to every e-mail you send after opening it. I ran the program through my virus scanning program, but apparently it is too new to be caught. PLEASE READ THE FOLLOWING INSTRUCTIONS! My computer did have the virus on it and I had to go through these steps to remove it. I cannot apologize enough for causing you this problem. It's pretty sad that even when you run virus scans religiously this sort of thing can still happen. Cassie A. Elam << Friends, I usually don't forward these messages about virus' because most are a hoax. This one is real and called the Happy99.exe Virus. Unless you have a newly UPDATED virus scan, it won't catch it. Below are directions on how to get rid of this virus. If you don't know much about computer files and the Windows Registry DO NOT ATTEMPT THIS. Serious damage could result. The Hampton Roads Law Enforcment Forum website, that I'm a member of, just went through a cleaning because of this virus. It will not destroy your hard drive or memory, it just plays pretty fireworks in your emails. My virus scan caught it before it could attach itself. If you have questions call me by phone 757-484-1711, if you have this virus. If you are not capable of following the directions, copy them and take your machine somewhere to have it checked. If you have recently run a program that displays fireworks in a small window that says "Happy New Year 1999", most likely your computer has this worm. First, let's get rid of that program and then we'll tell you more about it. NOTE: As far as we know, this worm ONLY affects Windows 95/98/NT users. Windows 3.1, Macintosh and other operating systems are apparently not affected. ------------ INSTRUCTIONS ------------ 1. Print out these instructions. 2. Click Start | Shut Down | "Restart Computer in MS-DOS mode" 3. At the DOS prompt, type the commands below that are in CAPS exactly, and press enter at the end of each line: 4. CD \WINDOWS\SYSTEM 5. DEL SKA.EXE (Note: If you get a File Not Found error, either you are not infected or this file is located somewhere else on your computer.) 6. DEL SKA.DLL 7. COPY WSOCK32.SKA WSOCK32.DLL 8. Answer "Yes" if it asks if you want to overwrite WSOCK32.DLL. Explanation: WSOCK32.SKA is a backup of the original WSOCK32.DLL made by the virus. You are replacing the modified DLL with the original. 9. Return to Windows by typing EXIT If upon rebooting, Windows displays an error message that it cannot find SKA.exe, continue with the steps below. Note: Using the Registry Editor incorrectly can lead to serious problems in Microsoft Windows and Windows applications. Erols/RCN Internet assumes no responsibility for mistakes or errors that result of incorrectly using the Registry Editor. 1. Click Start | Run, then type regedit and click OK. 2. Click at the + to the left of HKEY_LOCAL_MACHINE 3. Click at the + to the left of Software 4. Click at the + to the left of Microsoft 5. Click at the + to the left of Windows 6. Click at the + to the left of CurrentVersion. 7. Look under the following folders: Run, RunOnce, RunOnceEx, RunServices, RunServicesOnce. Check for SKA.EXE and select it if it is there. Hit the Delete key. 8. Close Regedit. There is a file that keeps track of anyone you may have inadvertently sent that file to. It is called: LISTE.SKA and you can find it under C:\WINDOWS\SYSTEM\LISTE.SKA ------------------------------------- WORMS? I'VE ONLY HEARD ABOUT VIRUSES! ------------------------------------- Merriam-Webster's Online Dictionary defines a worm as: "a usually small self-contained computer program that invades computers on a network and usually performs a malicious action." -------------------------- SO WHAT DOES THIS WORM DO? -------------------------- The Happy99.exe is more of a nuisance than a threat. It doesn't delete any files on your computer. It doesn't open a "back door" into your computer (as our next TIP describes). Basically, every time you send an e-mail or post to a newsgroup, you send a copy of the worm to the recipients of your message. And if they run the program, they get infected and then their messages will send out the worm, and so on. For more information, visit the sites below: http://www.zdnet.com/zdnn/stories/news/0,4586,2208275,00.html http://beta.nai.com/public/datafiles/valerts/vinfo/w32ska.htm http://www.anchordesk.com/a/adt0215nk/3093.html http://www.geocities.com/SiliconValley/Heights/3652/SKA.HTM >>