-Caveat Lector- FYI, from Erols.com support staff. > ----------------- > TIP OF THE WEEK I - Happy99.exe worm - (New) > ----------------- > Our e-mail support staff answers hundreds of e-mails a day. In the > past week, at least five customers have inadvertently sent us this > Happy99.exe worm. We figure that about 2 percent of the > mail we get is now carrying the Happy99.exe worm and we'd like to get > that figure back to zero percent. > > If you have recently run a program that displays fireworks in a small > window that says "Happy New Year 1999", most likely your computer has > this worm. > > First, let's get rid of that program and then we'll tell you more about > it. > > NOTE: As far as we know, this worm ONLY affects Windows 95/98/NT users. > Windows 3.1, Macintosh and other operating systems are apparently not > affected. > > ------------ > INSTRUCTIONS > ------------ > 1. Print out these instructions. > 2. Click Start | Shut Down | "Restart Computer in MS-DOS mode" > 3. At the DOS prompt, type the commands below that are in CAPS exactly, > and press enter at the end of each line: > 4. CD \WINDOWS\SYSTEM > 5. DEL SKA.EXE (Note: If you get a File Not Found error, either you > are not infected or this file is located somewhere else on your > computer.) > 6. DEL SKA.DLL > 7. COPY WSOCK32.SKA WSOCK32.DLL > 8. Answer "Yes" if it asks if you want to overwrite WSOCK32.DLL. > Explanation: WSOCK32.SKA is a backup of the original WSOCK32.DLL > made by the virus. You are replacing the modified DLL with the > original. > 9. Return to Windows by typing EXIT > > If upon rebooting, Windows displays an error message that it cannot > find SKA.exe, continue with the steps below. Note: Using the Registry > Editor incorrectly can lead to serious problems in Microsoft Windows > and Windows applications. Erols/RCN Internet assumes no responsibility > for mistakes or errors that result of incorrectly using the Registry > Editor. > > 1. Click Start | Run, then type regedit and click OK. > 2. Click at the + to the left of HKEY_LOCAL_MACHINE > 3. Click at the + to the left of Software > 4. Click at the + to the left of Microsoft > 5. Click at the + to the left of Windows > 6. Click at the + to the left of CurrentVersion. > 7. Look under the following folders: Run, RunOnce, RunOnceEx, > RunServices, RunServicesOnce. Check for SKA.EXE and select it if it > is there. Hit the Delete key. > 8. Close Regedit. > > There is a file that keeps track of anyone you may have inadvertently > sent that file to. It is called: LISTE.SKA and you can find it under > C:\WINDOWS\SYSTEM\LISTE.SKA > > ------------------------------------- > WORMS? I'VE ONLY HEARD ABOUT VIRUSES! > ------------------------------------- > Merriam-Webster's Online Dictionary defines a worm as: "a usually small > self-contained computer program that invades computers on a network and > usually performs a malicious action." > > -------------------------- > SO WHAT DOES THIS WORM DO? > -------------------------- > The Happy99.exe is more of a nuisance than a threat. It doesn't delete > any files on your computer. It doesn't open a "back door" into your > computer (as our next TIP describes). Basically, every time you send > an e-mail or post to a newsgroup, you send a copy of the worm to the > recipients of your message. And if they run the program, they get > infected and then their messages will send out the worm, and so on. > > For more information, visit the sites below: > http://www.zdnet.com/zdnn/stories/news/0,4586,2208275,00.html > > http://beta.nai.com/public/datafiles/valerts/vinfo/w32ska.htm > > http://www.anchordesk.com/a/adt0215nk/3093.html > > http://www.geocities.com/SiliconValley/Heights/3652/SKA.HTM > DISCLAIMER: The above message is being forwarded, in its entirety, as it relates to the "Happy99.exe" worm, as received by sender from Erols.com. While the sender has no reason to doubt Erols.com, make these changes _at your own risk_. The sender will not be held liable for any computer problems or Internet difficulties that _may_ result from the changes as noted above from Erols.com. Erols.com can be reached at http://www.erols.com. Feel free to forward to others that you think may have received this worm. DECLARATION & DISCLAIMER ========== CTRL is a discussion and informational exchange list. Proselyzting propagandic screeds are not allowed. Substance�not soapboxing! These are sordid matters and 'conspiracy theory', with its many half-truths, misdirections and outright frauds is used politically by different groups with major and minor effects spread throughout the spectrum of time and thought. That being said, CTRL gives no endorsement to the validity of posts, and always suggests to readers; be wary of what you read. CTRL gives no credeence to Holocaust denial and nazi's need not apply. Let us please be civil and as always, Caveat Lector. ======================================================================== Archives Available at: http://home.ease.lsoft.com/archives/CTRL.html http:[EMAIL PROTECTED]/ ======================================================================== To subscribe to Conspiracy Theory Research List[CTRL] send email: SUBSCRIBE CTRL [to:] [EMAIL PROTECTED] To UNsubscribe to Conspiracy Theory Research List[CTRL] send email: SIGNOFF CTRL [to:] [EMAIL PROTECTED] Om
