KB 23

Happy99 virus and how to get rid of it

Article:23
Created:2000-05-23 10:51:44
Categories:
  Windows 95
  Windows 98
  Virus Information

Question or Symptom

I am told all my emails have a 'happy99' attachment. What is this?

Resolution

Happy99.exe is an email virus, and the fact that we received a copy of it from you indicates that your machine has been infected.

The way this virus works is that it is sent to you as an email attachment. When you execute the attachment, the program displays a graphical fireworks display. While you are watching the fireworks, Happy99.exe is working in the background to infect your computer with the virus. After your machine is infected, every email message you send will be surreptitiously accompanied by the Happy99.exe virus attachment. This is how the virus replicates itself and infects new people.

Luckily, the Happy99.exe virus is relatively easy to remove, and we are not aware of any instance of the virus deleting or changing data files on the computers it infects.

How to tell if you've been infected:

---

Check the \WINDOWS\SYSTEM folder on your PC for these files:

   1. SKA.EXE 
   2. SKA.DLL 
   3. WSOCK32.SKA 
 

If you find these files then your PC has been infected by Happy99.exe.

How to remove the Happy99.exe virus/worm:

---

To remove Happy99.exe do the following:

IMPORTANT: Make *sure* that you have WSOCK32.SKA file before deleting WSOCK32.DLL. Also be very careful with spelling and make sure that you renamed the file properly.

   1. Close down all Internet applications (Web Browser, Email, etc.)
   2. Delete SKA.EXE, SKA.DLL and WSOCK32.DLL 
   3. Rename WSOCK32.SKA as WSOCK32.DLL 
 

If you have a version of Windows which has Internet Explorer integrated with Windows, you may have to do this in MS-DOS mode. To do that:

   1. Shut down windows with the RESTART IN MS-DOS MODE option. 
   2. At the prompt C:\ prompt, type the following commands:
 
        cd \windows\system
        del wsock32.dll
        rename wsock32.ska wsock32.dll
 
   3. Then restart your computer.
 

And finally, open the file C:\WINDOWS\SYSTEM\liste.ska in your NOTEPAD to see a list of other people who you may have infected with the Happy99.exe worm/virus.

If you have trouble removing this virus, let us know and we will try to help.

Related URLS

 http://www.symantec.com/avcenter/
 http://www.datafellows.com/vir-info/
 http://www.macaffee.com/