Boot aja pake disket.
-----Original Message-----
From: Tomy <[EMAIL PROTECTED]>
To: Milis DIVNET <[EMAIL PROTECTED]>; Milis STTTelkom
<[EMAIL PROTECTED]>
Date: Kamis, 11 Maret 1999 8:43
Subject: [stttelkom] Fw: VIRUS..this real not just hoax
>Gimana kalo terjadi pada Win NT ??
>Ada rekans yg bisa bantu ??
>Gimana saya bisa masuk ke "start computer in MS-DOS" dgn Win NT ??
>Thanks
>
>
>-----Original Message-----
>From: Maria Abdulkadir <[EMAIL PROTECTED]>
>Date: Kamis 11 Maret 1999 9:33
>Subject: VIRUS..this real not just hoax
>
>
>If you received Happy99.exe..DELETE it. Because I already run this file.
>When executed, the program opened a windows showing a firework display to
>disguise other application in action. This program copies itself as SKA.exe
>and extract a DLL file, the modifies WSOCK32.DLL in Windows\system
directory
>and copies the original WSOCK32.DLL to WSOCK32.SKA.
>And this program will be triggered everytime when a connect or send
activity
>is detected. It happened to me also, when I was checking and replying some
>emails to my friends. It did send and attach itself automatically to my
>friends. So some of my friends got infected too.
>
>Luckily this program is not the real wild virus, it just a worm. But it
will
>always show you an annoying message that about 'restriction in your
>application'.
>
>I felt strange and I looked at to my Windows 95's currently running program
>by pressing CTRL-ALT-DEL and saw SKA application running.
>I do not run this application, so I just kill it. And then everything back
>to normal.
>But not just that, this file SKA will run next time you start up your
>computer.
>What you should do are :
>1. start your computer in MS-DOS.
>2. delete windows\system\ska.exe and Ska.dll
>3. delete windows\system\wsock32.dll
>4. rename wsock32.ska to wsock32.dll
>5. delete the downloaded file, named Happy99.exe
>
>Or You can visit this site by Norton for details.
>http://www.symantec.com/avcenter/venc/data/happy99.worm.html
>
>
>
>
>
