P3D "Happy99" worm - more data

["Steve Hughes" <steve@xxxxxxxxxxx>]

Hi,

>If anyone ran the attachment "Happy99", you should do a search on your
Windows >directory for "ska.exe" and "ska.dll" and delete them both. They
are created when you >run the program.
>
>If your don't you will start to spread the dam thing.

I forgot a detail: the virus creates a new, modified copy, of one of the
Windows systems files "wsock32.dll". It copies the original using the name
"wsock32.ska". To change this file back you need to reboot your machine in
DOS mode then issue the following commands:

ren wsock32.dll wsock32.vir
ren wsock32.ska wsock32.dll
del wsock32.vir
exit

Be careful when you do this as "wsock32.dll" is essential for TCP/IP
communications.
Some virus scanner programs may be able to clean this up for you.

Complete data on this virus is available at
http://beta.nai.com/public/datafiles/valerts/vinfo/w32ska.htm

Hope this helps.


Steve A. Hughes
S&S Solutions
steve@xxxxxxxxxxxxxxxxxx


------------------------------