Syafril,
On Friday, December 03, 1999, at 20:47 you wrote:
SH> Sorry Leif, I have other opinion. AFAIK Happy99.exe is a Trojan
SH> Virus (Hoax ?)
Happy99.exe is not a hoax, and due to its propagation properties, it
is actually considered a worm. See McAfee's web page concerning
SKA/Happy99.exe at: http://vil.mcafee.com/vil/vpe10144.asp
SH> which infected to mailer with MAPI capable such
SH> Outlook97/98/2000, Outlook Express 4/5, Exchange Client.
This is also false. SKA directly patches the WSOCK32.DLL and makes
hooks to any SMTP or News activities. This allows SKA to "infect" any
outgoing message that is sent via SMTP or usenet news.
SH> Luckyly The Bat! not MAPI capable, yet; in the next version if The
SH> Bat! have MAPI capability, we also must aware with this kind of
SH> viruses (Mike not use The Bat! at the first time sending msg with
SH> Happy99.exe)
MAPI has nothing to do with it, because SKA is not MAPI dependent.
SH> Trojan or hoax viruses can't be detected by "common anti virus"
SH> such McAfee or NAV, just like "macro viruses" it's need special
SH> treatment.
This is also false, NAV and McAfee now include signatures for SKA. SKA
will be detected by either moving, copying, renaming, saving, opening
etc. as well as a the normal directory/disk scan. My point to John was
that neither NAV nor McAfee will scan a UUencoded file in messages in
TB, or at least I am not aware that it can. For NAV to detect SKA, the
file must be UUdecoded and saved (or attempted to save) to disk.
SH> There are a lot of Happy99.exe anti virus removement at
SH> www.winfiles.com
This I agree completely with, however, they all basically automate the
steps that I discussed on removing it.
A Nobel Peace Prize? I'd kill for one of those.
Leif Gregory
--
TBUDL/TBBT List Moderator
ICQ 216395 <[EMAIL PROTECTED]>
Web Site <http://www.pcwize.com>
TBUDL FAQ <http://www.pcwize.com/thebat/faq.shtml>
Using The Bat! 1.38 Beta/5 under Windows 98 4.10 Build 1998
on a Pentium 266 with 64MB.
--
--------------------------------------------------------------
View the TBUDL archive at http://tbudl.thebat.dutaint.com
To send a message to the list moderation team double click here:
<mailto:[EMAIL PROTECTED]>
To Unsubscribe from TBUDL, double click here and send the message:
<mailto:[EMAIL PROTECTED]>
--------------------------------------------------------------
