Happy 99 exe

This was the start of a particularly virulent epidemic.

Happy 99 read the message, fireworks, but quite a boring little display .
It came from a friend, so of course (in those far off days) one opened it.

I thought nothing of it until much later when I received an e-mail from an associate,
and immediately following it was another blank e-mail from the same company,
containing only happy 99.exe.

I deleted it by instinct...(I had one computer in the office that had lost it's hard drive by now ) and wrote to him immediately asking if he had just sent me anything else.
He knew nothing about it.

That's the beauty of this pesky little Trojan , you trust its source, and so you will probably open it.

Then it attaches itself to all your outgoing messages and infects everyone else.

If you don't open it, you will be ok, then just delete it.
But if you do open it, follow the instructions below, and then write to everyone you ever contacted and tell them how to fix it and to inform all their contacts.
(taken from Symantec's Virus Index)

When being executed, the program also opens a window entitled "Happy New Year 1999 !!" showing a firework display to disguise its other actions. The program copies itself as SCALENE and extracts a DLL that it carries as SKA.DLL into WINDOWS\SYSTEM directory. It also modifies WSOCK32.DLL in WINDOWS\SYSTEM directory and copies the original WSOCK32.DLL into WSOCK32.SKA.

WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The modification to WSOCK32.DLL allows the worm routine to be triggered when a connect or send activity is detected. When such online activity occurs, the modified code loads the worm's SKA.DLL. This SKA.DLL creates a new email or a new article with UUENCODED HAPPY99.EXE inserted into the email or article. It then sends this email or posts this article.

If WSOCK32.DLL is in use when the worm tries to modify it (i.e. a user is online), the worm adds a registry entry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE

The registry entry loads the worm the next time Windows start.

Removing the worm manually:

delete WINDOWS\SYSTEM\SKA.EXE

delete WINDOWS\SYSTEM\SKA.DLL

in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK

in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL

delete the downloaded file, usually named HAPPY99.EXE

Windows prevents you to do step #3 and #4 above if the machine is still connected to the Internet. The file "windows\system\wsock32.dll" is used whenever the machine is connected to Internet (i.e. through dial-up or LAN connection).

If you are using dial-up connection (i.e. America Online), you need to do the following:

terminate internet connection
delete WINDOWS\SYSTEM\SKA.EXE
delete WINDOWS\SYSTEM\SKA.DLL

in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL delete the downloaded file, usually named HAPPY99.EXE

If you are connected to Internet through LAN (i.e. in the office or cable modem), you need to do the following:

From the Start menu, select shutdown-restart in MS DOS mode

type CD \windows\system when DOS prompt (C:\)appears

type RENAME WSOCK32.DLL WSOCK32.BAK

type RENAME WSOCK32.SKA WSOCK32.DLL

type DEL SKA.EXE

type DEL SKA.DLL

That's It, you are now clear. Happy 99 was just one of thousands of pesky virii which will try to infect your computer every day, as we get more aware of them, the perpetrators become cleverer and mask their goods more cleverly. The one tool I have found invaluable over the years is this.

We have recently become an affiliate as so many people ask what we use as company protection. It is very reasonably priced wherever in the world you are (this seems to make a difference!) and updates are available on an almost daily basis, which if you set to download automatically will keep you up to date with latest virus treats.

I have used others and must say that for overall user friendliness, cost effectiveness and the fact that it works - it is the best by far.