PROBLEM:
A virus called Happy99.exe (or some other name with the exe extension)
that is sent to you as an attachment of a email.
SOLUTION --
How to remove it from your system:
Note: Steps marked optional are not absolutely necessary and are
completely safe to skip.
1.Click Start, then Shut Down, then "Restart Computer in MS-DOS
mode", then click Yes. It's important to do this
so you can make the necessary changes.
2.At the DOS prompt type this exactly and press enter at the end of
each line:
CD \WINDOWS\SYSTEM
If your Windows folder is not called WINDOWS
then substitute the name of your
Windows folder instead, for example:
CD \WIN95\SYSTEM
3.Delete SKA.EXE and SKA.DLL by typing
DEL SKA.EXE
DEL SKA.DLL
If you get "File not found" you're either not
infected or in the wrong directory. Make sure
you're in your Windows System directory; check to
see if you followed step 2 exactly.
4.Copy WSOCK32.SKA to WSOCK32.DLL by typing
COPY WSOCK32.SKA WSOCK32.DLL
Answer "Yes" if it asks if you want to overwrite
WSOCK32.DLL.
Explanation: WSOCK32.SKA
is a backup of the original WSOCK32.DLL made by the
virus. You are replacing the modified DLL with the original.
5.Optional Delete WSOCK32.SKA by typing
DEL WSOCK32.SKA
You can leave WSOCK32.SKA on your system. It
is a copy of your original
WSOCK32.DLL
Do not delete WSOCK32.SKA if you are unable
to replace WSOCK32.DLL with
WSOCK32.SKA.
6.Return to Windows by typing
EXIT
7.Optional Click Start, then Run, then type regedit in the text box,
then click OK. Click
HKEY_LOCAL_MACHINE, then
Software, then Microsoft, then Windows, then
CurrentVersion. Under
RunOnce check for SKA.EXE and select it if it is there. Press
delete and then click Yes.
Close Regedit. Don't change anything else without making a
backup of the registry first.
If you don't find SKA.EXE in the registry, it doesn't
mean you're not infected.
SKA.EXE is only added to the registry if HAPPY99.EXE is
unable to modify WSOCK32.DLL
when you run it.
8.Optional Choose Start, Programs, Accessories, Notepad, choose File,
then Open then type
C:\WINDOWS\SYSTEM\LISTE.SKA in the File Name
box. Warn the people on
the list, then delete LISTE.SKA.
|