A real Virus for Newsgroup participants

[moulton]

Dakkon and Tony.

I deleted it immediately. Eudora offers a good set of filters. This one must be pretty viscious because I received the following email today from the software I use to mail my resumes to new clients:

<font color=blue>
Dear AY Mail Customer,

The note below have very important information on
the Happy.exe virus. This virus is spread with
e-mail and since you use AY Mail to send e-mail
messages to thousands of people, the damages that
you can cause may be very serious.

The Happy.exe virus spreads over the Internet
as a binary attachment. When recipients receive
the e-mail with the attachment and double-click
the attachment, the virus celebrates them with
new 1999 year, and replaces the WSOCK32.DLL in
their WINDOWS\SYSTEM directory. This malicious
WSOCK32.DLL sniffs e-mail addresses and sends
the virus to every recipient.

Does AY Mail work on infected machines?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

It may. The virus is not written very well,
so frequently it crashes AY Mail. If you
see your AY Mail crashed, chances are that
your PC is infected.

How do I know that my PC is infected?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Search your computer for the SKA.EXE,
SKA.DLL, and WSOCK32.SKA files. If you
found any of them, the computer is
infected.

Is there any cure?
~~~~~~~~~~~~~~~~~~

Below are instructions by Richard A. Boulay:

After copying the two files to be deleted
onto a floppy, just in case. Do this

1.delete WINDOWS\SYSTEM\SKA.EXE
2.delete WINDOWS\SYSTEM\SKA.DLL
3.replace WINDOWS\SYSTEM\WSOCK32.DLL
with WINDOWS\SYSTEM\WSOCK32.SKA
4.delete the downloaded file, usually
named HAPPY99.EXE

If you are infected with it you won't be able to
delete the .dll file in Windows. You will have to
restart in DOS mode and do it manually.

How do I protect my computer?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Newer open any attachments unless you
are absolutely sure what they are. The
virus may have different names, so you
never know.

What if I have more questions?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

We do not have any extra information on
the virus. You may want to read the
following article:

http://www.symantec.com/avcenter/venc/d ... .worm.html

Best Regards. Andrey Yastrebov.
---
AY Software Corporation
http://www.aysoft.com/
<font color=green>



------------------
Allen at [email]uechi@ici.net">uechi@ici.net</A> on <A HREF="http://www.uechi-ryu.org[/email]