Happy 99 - Guilty as charged!

["Thomas Friese" <tfriese@intergate.bc.ca>]

Indeed, I plead guilty. I used to say that I have never seen
a virus.  Well those days are over - luckily it's not a
serious one.  This little program shows you a nice fireworks
display when you run it.  It also alters your internet
configuration in order to attach itself to EVERY email or
newsgroup posting you make.  Harmless but irritating.  Its
like walking around with toilet paper stuck to your shoe!  I
am sorry if I infected any of you (Olaf!)  If you are
infected with this virus do the following rid yourself of
the problem:

1.    count yourself lucky your hard drive wasn't erased or
worse
2.    using windows explorer, go to c:\windows\system
3.    DELETE the file named SKA.EXE (if its not there, you
don't have the virus)
4.    DELETE the file named WSOCK32.DLL*
5.    RENAME the file WSOCK32.SKA to WSOCK32.DLL
6.    restart your system
7.    send yourself an email to make sure you are virus-free


*If you get an error message saying "cannot delete file
because it is in use by windows", then you'll have to go
under START | SHUT DOWN  and choose [Restart in DOS mode],
then from the c:\ prompt, type
    cd windows
    cd system
    delete wsock32.dll
    rename wsock32.ska wsock32.dll

-----Original Message-----
From: owner-ernst-juenger-l@maillist.ox.ac.uk
[mailto:owner-ernst-juenger-l@maillist.ox.ac.uk]On Behalf Of
Olaf
Schroeter
Sent: March 12, 1999 9:34 AM
To: ernst-juenger-l@maillist.ox.ac.uk
Subject: [ejlist] Happy99.worm


Hello out there,

the virus is a happy99.worm. I qoute from Norton AntiVirus:
"It modifies
WSOCK32.dll to send itself as an Attachment when a posting
is made to
USENET or MAIL. Delete SKA.EXE and SKA.DLL in WINDOWS/SYSTEM
folder and
replace WSOCK32:DLL with WSOCK32.SKA in WINDOWS/SYSTEM
folder."

The newest version of Norton Anti Virus found and deleted
it.

At http://www.mals.net/happy99.htm there is a "wormcure" to
download. I
don't know whether it works, though.

Especially Thomas should look at his system, as I got this
charming
creature under his name.

Greetings from Berlin and I hope I haven't done any damage,

Olaf




==================** You are subscribed to ernst-juenger-l.
To leave send a mail to Majordomo@maillist.ox.ac.uk
containing: unsubscribe ernst-juenger-l **