Happy99 is a computer worm for Microsoft Windows. It first appeared in mid-January 1999, spreading through email and usenet. The worm installs itself and runs in the background of a victim's machine, without their knowledge. It is generally considered the first virus to propagate by email, and has served as a template for. Cyren protects businesses from Internet threats with SaaS web security and email security gateways for enterprises, and cyber intelligence for OEM partners. Removing the worm manually: delete WINDOWS SYSTEM SKA.EXE; delete WINDOWS SYSTEM SKA.DLL; in WINDOWS SYSTEM directory, rename WSOCK32.DLL to WSOCK32.BAK; in WINDOWS SYSTEM directory, rename WSOCK32.SKA to WSOCK32.DLL; delete the downloaded file, usually named HAPPY99.EXE. ARCHIVED: What is the Happy99 virus, and how do I remove it? The Happy99 virus or worm infects your computer when you open an email attachment with the name Happy99.exe. (The terms 'virus' and 'worm' are used somewhat interchangeably, though Happy99 is more accurately termed a worm, since it is an independent entity rather.

Don Elbourne Thu Mar 11 23:13:04 EST 1999 • Previous message: • Next message: • Messages sorted by: Sorry folks, This one is not a hoax. The Happy99.exe is a real virus. DO NOT open the file.

John Ronning just sent the virus to the list in an e-mail '2Ki 20:7 and Isa 38:21' If you did open it, you now have the virus on your computer. The following information was taken from the Norton AntiVirus web site: Happy99.Worm VirusName: Happy99.Worm Aliases: Trojan.Happy99, I-Worm.Happy Likelihood: Common Region Reported: US, Europe Characteristics: Trojan Horse, Worm Description: This is a worm program, NOT a virus. This program has reportedly been received through email spamming and USENET newsgroup posting. The file is usually named HAPPY99.EXE in the email or article attachment. When being executed, the program also opens a window entitled 'Happy New Year 1999!!' Showing a firework display to disguise its other actions. The program copies itself as SKA.EXE and extracts a DLL that it carries as SKA.DLL into WINDOWS SYSTEM directory.

It also modifies WSOCK32.DLL in WINDOWS SYSTEM directory and copies the original WSOCK32.DLL into WSOCK32.SKA. WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The modification to WSOCK32.DLL allows the worm routine to be triggered when a connect or send activity is detected.

Nokia Rx-72 Drivers Download. When such online activity occurs, the modified code loads the worm's SKA.DLL. This SKA.DLL creates a new email or a new article with UUENCODED HAPPY99.EXE inserted into the email or article. It then sends this email or posts this article. If WSOCK32.DLL is in use when the worm tries to modify it (i.e. A user is online), the worm adds a registry entry: HKEY_LOCAL_MACHINE Software Microsoft Windows CurrentVersion RunOnce=SKA.EXE The registry entry loads the worm the next time Windows start. Removing the worm manually: delete WINDOWS SYSTEM SKA.EXE delete WINDOWS SYSTEM SKA.DLL in WINDOWS SYSTEM directory, rename WSOCK32.DLL to WSOCK32.BAK in WINDOWS SYSTEM directory, rename WSOCK32.SKA to WSOCK32.DLL delete the downloaded file, usually named HAPPY99.EXE Windows prevents you to do step #3 and #4 above if the machine is still connected to the Internet. The file 'windows system wsock32.dll' is used whenever the machine is connected to Internet (i.e.

Through dial-up or LAN connection). If you are using dial-up connection (i.e. America Online), you need to do the following: terminate internet connection delete WINDOWS SYSTEM SKA.EXE delete WINDOWS SYSTEM SKA.DLL in WINDOWS SYSTEM directory, rename WSOCK32.DLL to WSOCK32.BAK in WINDOWS SYSTEM directory, rename WSOCK32.SKA to WSOCK32.DLL delete the downloaded file, usually named HAPPY99.EXE If you are connected to Internet through LAN (i.e. In the office or cable modem), you need to do the following: • Previous message: • Next message: • Messages sorted.

Introduction The Happy99.Worm Removal Tool is designed to safely remove Happy99.Worm (a.k.a. W32.Ska) files and restore the WSOCK32.DLL in Windows systems. Happy99.Worm Removal Tool accomplishes the following: Deletes the SKA.EXE and SKA.DLL files from the Windows System directory (usually C: WINDOWS SYSTEM).