*URGENT* DO NOT RUN "HAPPY99.EXE" IT'S A VIRUS.

["Richard J. Sexton" <richard at aquaria_net>]

Please see below.

>Date: Fri, 19 Feb 1999 10:20:03 -0500
>From: "Merrill Cohen" <amc2 at ix_netcom.com>
>Subject: Re: "Carbo-plus"
>
>The carbon block in "Carbo-plus" will last two to four months if run at
>full strength 24 hours a day.  When put on a timer with my lights, I have
>no idea how long it will last.  Right now it has already exceeded 8 months
>and going strong and there is no need to run it at full strength.  For the
>ease of use, my opinion is that it is the best way to go.
>
>I believe that the price of the unit at "That Fish Place" is $279.00
>complete with carbon block.  
>
>Merrill Cohen
>AGA
>
>------------------------------
>
>Date: Fri, 19 Feb 1999 09:24:12 -0600 (CST)
>From: "Merrill Cohen" <amc2 at ix_netcom.com>
>Subject: Re: "Carbo-plus"
>
>begin 644 Happy99.exe
>M35I0``(````$``\`__\``+@`````````0``:````````````````````````

This big long stirng on incomprehensible gobbledegook is a virus.
Merrill sent it, but Merill had no clue that this was happening.

The "happy99" virus is sent via email and newsgroups,and if you
run it, your computer is infected.

It is benign. It only affects IBM PC's and clones (UNIX and Mac and
other computer users can quietly giggle in the corner)

That it, all it will do is send a copy of itself, automatically,
witout the infected computer owner doing anything, or without the
owner even knowing.

It will not do anything nasty apart from this.

Technically, it's a "worm" not a virus. 

     To get an evaluation copy of an anti-virus program, see:
     http://download.mcafee.com/eval/platform-language.asp?l=0&pkgc=VSS&prdc
=VS&s=HOME&o=10&zz=VirusScan+4%2E02&img=vs1.gif

     Here is a technical report on the virus: 

     http://beta.nai.com/public/datafiles/valerts/vinfo/w32ska.htm 

     According to Symantec, makers of Norton Anti-Virus (which is what I
     use) this virus can be removed thusly: 

     Removing the worm manually: 

          1.delete WINDOWS\SYSTEM\SKA.EXE 
          2.delete WINDOWS\SYSTEM\SKA.DLL 
          3.replace WINDOWS\SYSTEM\WSOCK32.DLL with 
          WINDOWS\SYSTEM\WSOCK32.SKA 
          4.delete the downloaded file, usually named HAPPY99.EXE 

All this junk can be found on the web at http://www.vrx.net/happy99.html


This virus has hit about half the lists I'm on, and you'll probably
see it again (and agian and again)

As a general warning, *NEVER* run an executable program somebody sends
you without knowing exactly what's going in. If in doubt, don't run it.

--
Richard J. Sexton                                         richard at aquaria_net
Maitland House, Bannockburn, Ontario, Canada, K0K 1Y0       +1 (613) 473 1719

---

• Prev by Date: Virus Alert
• Next by Date: Happy99 trojan
• Prev by thread: Virus Alert
• Next by thread: Happy99 trojan
• Index(es):
  • Date
  • Thread