Re: VIRUS ALERT!

From: dano@ott.net
Date: Fri Mar 12 1999 - 09:47:55 EST


I hate to admit it.. but this one wasn't a hoax.. I found out from
PERSONAL experience if you get my drift.. after downloading e
mail from BibleHebrew mailing list (B-Hebrew). Boy do I feel
stupid.. I sure hope I didn't sent it on to anybody.

> Sorry folks,
>
> This one is not a hoax. The Happy99.exe is a real virus. DO NOT open the
> file. John Ronning just sent the virus to the list in an e-mail "2Ki 20:7
> and Isa 38:21"
>
> If you did open it, you now have the virus on your computer.
>
> The following information was taken from the Norton AntiVirus web site:
>
> http://www.symantec.com/avcenter/venc/data/happy99.worm.html
>
> Happy99.Worm
> VirusName: Happy99.Worm
> Aliases: Trojan.Happy99, I-Worm.Happy
> Likelihood: Common
> Region Reported: US, Europe
> Characteristics: Trojan Horse, Worm
>
>
>
> Description:
>
>
> This is a worm program, NOT a virus. This program has reportedly been
> received through email spamming and USENET newsgroup posting. The file is
> usually named HAPPY99.EXE in the email or article attachment.
>
> When being executed, the program also opens a window entitled "Happy New
> Year 1999 !!" showing a firework display to disguise its other actions. The
> program copies itself as SKA.EXE and extracts a DLL that it carries as
> SKA.DLL into WINDOWS\SYSTEM directory. It also modifies WSOCK32.DLL in
> WINDOWS\SYSTEM directory and copies the original WSOCK32.DLL into
> WSOCK32.SKA.
>
> WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The
> modification to WSOCK32.DLL allows the worm routine to be triggered when a
> connect or send activity is detected. When such online activity occurs, the
> modified code loads the worm's SKA.DLL. This SKA.DLL creates a new email or
> a new article with UUENCODED HAPPY99.EXE inserted into the email or article.
> It then sends this email or posts this article.
>
> If WSOCK32.DLL is in use when the worm tries to modify it (i.e. a user is
> online), the worm adds a registry entry:
>
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE
>
> The registry entry loads the worm the next time Windows start.
>
>
> Removing the worm manually:
>
>
> delete WINDOWS\SYSTEM\SKA.EXE
> delete WINDOWS\SYSTEM\SKA.DLL
> in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK
> in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL
> delete the downloaded file, usually named HAPPY99.EXE
> Windows prevents you to do step #3 and #4 above if the machine is still
> connected to the Internet. The file "windows\system\wsock32.dll" is used
> whenever the machine is connected to Internet (i.e. through dial-up or LAN
> connection).
>
>
> If you are using dial-up connection (i.e. America Online), you need to do
> the following:
>
>
> terminate internet connection
> delete WINDOWS\SYSTEM\SKA.EXE
> delete WINDOWS\SYSTEM\SKA.DLL
> in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK
> in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL
> delete the downloaded file, usually named HAPPY99.EXE
>
> If you are connected to Internet through LAN (i.e. in the office or cable
> modem), you need to do the following:
>
>
> >From the Start menu, select shutdown-restart in MS DOS mode
> type CD \windows\system when DOS prompt (C:\)appears
> type RENAME WSOCK32.DLL WSOCK32.BAK
> type RENAME WSOCK32.SKA WSOCK32.DLL
> type DEL SKA.EXE
> type DEL SKA.DLL
>
>
> Safe Computing:
>
>
> This worm and other trojan-horse type programs demonstrate the need to
> practice safe computing. One should not execute any executable-file
> attachment (EXE, SHS, MS Word or MS Excel file) that comes from an email or
> a newsgroup article from an untrusted source.
>
> Norton AntiVirus users can protect themselves from this virus by downloading
> the current virus definitions either through LiveUpdate or from the
> following webpage:
>
> http://www.symantec.com/avcenter/download.html
>
> Write-up by: Raul K. Elnitiarta
> March 2, 1999
>

---
B-Greek home page: http://sunsite.unc.edu/bgreek
You are currently subscribed to b-greek as: [cwconrad@artsci.wustl.edu]
To unsubscribe, forward this message to leave-b-greek-329W@franklin.oit.unc.edu
To subscribe, send a message to subscribe-b-greek@franklin.oit.unc.edu


This archive was generated by hypermail 2.1.4 : Sat Apr 20 2002 - 15:40:20 EDT