I have received several copies of the HAPPY99 VIRUS (or WORM) from email that was sent to ROOTSWEB MAILING LIST over the last few days. Please read the follwing message. D. Scott Dingler Listowner I borrowed this explanation from my colleague who has the SCROOTS list. He is a computer guru. Please read carefully. DO NOT SEND ANY MESSAGES TO THE LIST ABOUT THIS PLEASE!!! NOTE: This warning is the exception to the rule. Do not follow this as and example and start sending virus warnings to the forum. This type of message is OFF TOPIC in the forum, unless posted by the Forum Manager. I've recently received several emails from various people containing an attached file named HAPPY99.EXE. Some of these were from Forum members. Some were addressed to the Forum, but they were blocked by our automatic screening program. The HAPPY99.EXE program is a WORM. See below for more information about what that means. If you receive a message with that file attached don't execute it - delete it immediately. _______________________ VirusName: Happy99.Worm Aliases: Trojan.Happy99, I-Worm.Happy Description: This is a worm program, NOT a virus. This program has reportedly been received through email spamming and USENET newsgroup posting. The file is usually named HAPPY99.EXE in the email or article attachment. When being executed, the program also opens a window entitled "Happy New Year 1999 !!" showing a firework display to disguise its other actions. The program copies itself as SKA.EXE and extracts a DLL that it carries as SKA.DLL into WINDOWS\SYSTEM directory. It also modifies WSOCK32.DLL in WINDOWS\SYSTEM directory and copies the original WSOCK32.DLL into WSOCK32.SKA. WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The modification to WSOCK32.DLL allows the worm routine to be triggered when a connect or send activity is detected. When such online activity occurs, the modified code loads the worm's SKA.DLL. This SKA.DLL creates a new email or a new article with UUENCODED HAPPY99.EXE inserted into the email or article. It then sends this email or posts this article. If WSOCK32.DLL is in use when the worm tries to modify it (i.e. a user is online), the worm adds a registry entry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE The registry entry loads the worm the next time Windows start. Removing the worm manually: 1. delete WINDOWS\SYSTEM\SKA.EXE 2. delete WINDOWS\SYSTEM\SKA.DLL 3. replace WINDOWS\SYSTEM\WSOCK32.DLL with WINDOWS\SYSTEM\WSOCK32.SKA 4. delete the downloaded file, usually named HAPPY99.EXE Safe Computing: This worm and other trojan-horse type programs demonstrate the need to practice safe computing. One should not execute any executable-file attachment (i.e. EXE, SHS, MS Word or MS Excel file) that comes from an email or a newsgroup article from an unknown or a untrusted source. Norton AntiVirus users can protect themselves from this worm by downloading the virus definitions updates released on Jan 28, 1999 or later either through LiveUpdate or from the following webpage: http://www.symantec.com/avcenter/download.html Write-up by: Raul K. Elnitiarta - January 28, 1999 ___________________ For more information regarding viruses see the following sites. http://www.mcafee.com/ http://www.symantec.com/avcenter http://www.symantec.com/avcenter/venc/data/happy99.worm.html http://www.earthlink.net/daily/tuesday/macroviruses http://www.cyberramp.net/hoax.htm Unsolicited, unexplained attachments are unacceptable! "... you CAN get a virus by reading an attachment in an email message, such as an MS Word or Excel document, which is infected by a macro virus. You can also get a virus by running an executable program (such as *.exe , *.com or *.bat) someone e-mails you as an attachment." -- SOURCE: http://www.cyberramp.net/hoax.htm Food For Thought: If the one that holds our future is the one that holds our hand, we will always have reason to give thanks for we will surely be blessed. Check out my Gealogy home page at http://www.mindspring.com/~sdingler/ Check out the Mailing Lists at http://www.rootsweb.com/~maillist/ D. Scott Dingler 711 Robin Court Woodstock, GA 30188 ********************************************************* * * * JESUS OUR SAVIOR WILL CARRY US ALL THE WAY !!!!!!! * * * *********************************************************