 |
This Information is VERY important Please read all of it.
What is HAPPY99?
HAPPY99 is a little program that launches several files that watch who you email and then keeps track of them in a file. It will then send them a second message with the HAPPY99.EXE file attached. If the recipient opens and executes it, they will have these files set up in their computer, they also will be sending it inadvertently with all their out going mail and so on. This is why it spreads so quickly. If you receive an attachment from ANYONE that says anything like HAPPY99, don't click on it (open it) simply erase or delete it and you will be fine. Remember even friends and people you know well could send it to you because they have been infected with it and they don't realize it. If you think you did look at it or opened it, follow the instructions below to remove it.
I TAKE NO RESPONSIBILITY FOR THIS FIX. USE AT YOUR OWN RISK!
To Remove the Worm Manually
|
A)delete WINDOWS\SYSTEM\SKA.EXE |
|
B)delete WINDOWS\SYSTEM\SKA.DLL |
|
in WINDOWS\SYSTEM\ directory, |
|
C)rename WSOCK32.DLL to WSOCK32.BAK |
|
in WINDOWS\SYSTEM\ directory, |
|
D)rename WSOCK32.SKA to WSOCK32.DLL |
|
E)delete the downloaded file, |
|
usually named HAPPY99.EXE |
Windows prevents you to do step #3 and #4 above if the machine is still connected to the Internet. The file "windows\system\wsock32.dll" is used whenever the machine is connected to Internet (i.e. through dial-up or LAN connection).
If you are using dial-up connection (Such as- America Online), you will need to do the following:
|
A)terminate internet connection |
|
B)delete WINDOWS\SYSTEM\SKA.EXE |
|
3)delete WINDOWS\SYSTEM\SKA.DLL |
|
in WINDOWS\SYSTEM\ directory, |
|
C)rename WSOCK32.DLL to WSOCK32.BAK |
|
in WINDOWS\SYSTEM\ directory, |
|
D)rename WSOCK32.SKA to WSOCK32.DLL |
|
E)delete the downloaded file, |
|
usually named HAPPY99.EXE |
If you are connected to Internet through LAN (office or cable modem), you need to do the following:
|
A)From the Start menu, select shutdown-restart in MS DOS mode |
|
B)type CD \windows\system when DOS |
|
prompt (C:\)appears |
|
C)type RENAME WSOCK32.DLL WSOCK32.BAK |
|
D)type RENAME WSOCK32.SKA WSOCK32.DLL |
|
E)type DEL SKA.EXE |
|
F)type DEL SKA.DLL |
Variant Information (Happy99 may now be know as Happy00)
There is a variant of Happy99.Worm called W32.Ska.B (alias W32.Ska2K.Worm). Norton AntiVirus is able to detect this as 'Happy99.Worm' because of its ability to detect variants with the signature of Happy99.Worm.
The major difference of this variant is the file name, which it attaches itself to email. This variant attaches itself as happy00.exe instead of happy99.exe. |
Screen Shot Of Happy99
|
|
Press Ctrl & D at the same time to bookmark this page
|
|
Thank You For your help Informing everyone about this problem. Please forward this site address to all your friends. Letting everyone know about this is the only way we can stop it.
Please Visit my main web site to show your support for this service
|
|
Site Directory