In a message dated 2/12/99 3:57:27 AM Pacific Standard Time, [email protected] writes: > > HI Everybody: > > I've gotten three warnings like the one below from the listowners of some > genealogy chat lists that I belong to, so I feel like this virus is real. > Personally, I haven't received this attachment - the listowners have > stopped it from being posted on their chatlists before it reached me. I'm > updating my Norton Anti-Virus as soon as I send this message out - I > recommend that ya'll do the same. > > Linda To the group... Most of these messages are called "Hoax Viruses" and as a computer network administrator, I always check them out before jumping the gun. This one is real. The following is what McAfee's website says about it. Cheryl Hawley --------------------------------------------------------- W32/Ska is a worm that was first posted to several newsgroups and has been reported to several of the AVERT Labs locations worldwide. When this worm is run it displays a message "Happy New Year 1999!!" and displays "fireworks" graphics. The posting on the newsgroups has lead to its propagation. It can also spread on its own, as it can attached itself to a mail message and be sent unknowingly by a user. Because of this attribute it is also considered to be a worm. AVERT cautions all users who may receive the attachment via email to simply delete the mail and the attachment. The worm infects a system via email delivery and arrives as an attachment called Happy99.EXE. It is sent unknowingly by a user. When the program is run it deploys its payload displaying fireworks on the users monitor. Note: At this time no destructive payload has been discovered. When the Happy.EXE is run it copies itself to Windows\System folder under the name SKA.EXE. It then extracts, from within itself, a DLL called SKA.DLL into the Windows\System folder if one does not already exist. ------------------------------------------------------------------------------ -----------------------------