A genuine , email spreadable (through an attachment) , virus arrived in my mailbox attached to a posting on this list today. The post, from Laurie Ford, arrived as two messages. One of these contained the attachement "Happy99.exe". This virus will only affect Windows OS machine, but both Windows OS and Macs can unfortunately pass it on to other users. (Don't give Laurie a hard time, he wouldn't have known that he had contracted it). Don't panic, the virus at least at this stage, is benign and doesn't do any serious damage (although it may cause you some problems when on the net) HOWEVER, it would be better to stamp it before someone does something nasty with it. It only directly affects Windows 95, 98 & NT users. People running MacOS, DOS, Windows 3.1 or Linux Operating systems can pass the virus on (by forwading on the email message together with iots attachment), but their own computers will not be affected. This is NOT another hoax like Good Times, Hackingburgh, AOL Trojan Virus,Penpal Greetings, AOL4FREE, Join the Crew, Bud Frogs/BUDDYLST, It takes guts to say "Jesus" etc etc etc The following post from Roger Holdsworthy (manager of the YARN list at Melbourne Uni, and who knows his stuff) provides some details of it. >From Roger: _________________________________________ I know I'm the first to warn of hoax virus messages, but here is one that is actually TRUE. It relates to an attachment called "happy99.exe" that will affect non-Mac machines if opened. Here's the information from our IT people. There's no indication that it has yet been transmitted through this e-mailing list, and I'm keen to keep it that way!!! With your help! It HAS been transmitted through one US-based list I'm on (but being a Mac person) I can transmit it but am not affected by it. At least until some nasty person invents a Mac version! Roger >From Greg Wadley (excerpts): There is a computer virus called HAPPY99 going around. It propagates itself by attaching to email messages. ... I've outlined below a procedure to follow if you receive such an email, and some information about the virus. HOW TO KNOW IF YOU RECEIVE THE VIRUS FILE Happy99 goes around as an email attachment. If you receive it in an email, there is no warning sign in the subject or author of the email. When you read the email, you will see it has an attached file called "happy99.exe". It is this attachment which is the virus, not the email itself. WHAT TO DO IF YOU RECEIVE EMAIL CONTAINING HAPPY99 Delete the email immediately, and delete the file "happy99.exe" from your hard disk (it should be in your Eudora or e-mail program attachments folder). Do not open or run the attached file happy99.exe, and do not forward it to other people. If you have a Macintosh computer, that's all there is to it. Happy99 can't run on a Mac, and will only propagate if you deliberately send it to others. If you have a Windows PC, read on ... EXTRA STEPS FOR WINDOWS USERS The virus can only infect your PC if you run the happy99.exe program that came with the email. If you have not run the program yet, simply delete the file "happy99.exe", and the email it came in. If you do run the happy99 program, it displays a window containing a fireworks animation. If you have seen this, you have the virus. Contact your IT support and seek advise on removing it. Do not use email on that computer until the virus is removed. If you can't get hold of IT support, and absolutely must use email, perform these steps to remove the virus first. Some of these steps may require the assistance of an experience Windows user. 1. Delete ska.exe and ska.dll from the \windows\system folder. 2. Restart in MS-DOS mode. 3. Change directory to \windows\system 4. Run these two DOS commands to restore the old Winsock file: ren wsock32.dll wsock32.bad ren wsock32.ska wsock32.dll 5. Restart Windows This should remove the virus. MORE INFORMATION ABOUT HAPPY99 Happy99 is probably benign (it probably won't damage your computer files). However we shouldn't take any chances with it - it should be removed immediately on detection. Malicious variants will surely appear before long, if they haven't already. Happy99 propagates in a clever way. It alters some of your Windows files that control internet access. Subsequently, every person you send an email message to, will receive a second email from you, containing the happy99 program (and no text). You won't know that this email is being sent, and it won't appear in your outbox. Happy99 keeps a list of people it sent itself to from you. It keeps this list in the text file c:\windows\system\liste.ska. When you remove the virus from your PC, it is worth checking this list, and warning the people on it that they may have received a virus from you. Happy99 is not a hoax, like GoodTimes and similar "email virus warning" messages that come around regularly. However it can only activate if it is run by the user (merely reading the email it came in doesn't do anything). This is typical of email viruses - you can't get a virus by simply reading email - you have to open or run an attachment. So, as a general rule, if you receive an attachment (Word doc, program etc) in email, check it for viruses before opening it. If it looks suspect, don't open it at all. Roger More information about happy99 can be found at a www page at: http://www.geocities.com/SiliconValley/Heights/3652/SKA.HTM which provides extensive details for anyone wishing to pursue the matter further, or who wants to know how to deal with it if they already have it. People with reasonably recent virus detection programs (i.e with virus definitions updated in the last six months) should be able to detrect the beast before it does any damage, Cheers Rod Rod Hagen [EMAIL PROTECTED] Hurstbridge, Victoria, Australia WWW http://www.netspace.net.au/~rodhagen ------------------------------------------------------- RecOzNet2 has a page @ http://www.green.net.au/recoznet2 and is archived at http://www.mail-archive.com/ To unsubscribe from this list, mail [EMAIL PROTECTED], and in the body of the message, include the words: unsubscribe announce or click here mailto:[EMAIL PROTECTED]?Body=unsubscribe%20announce This posting is provided to the individual members of this group without permission from the copyright owner for purposes of criticism, comment, scholarship and research under the "fair use" provisions of the Federal copyright laws and it may not be distributed further without permission of the copyright owner, except for "fair use." RecOzNet2 is archived for members @ http://www.mail-archive.com/
