Thomas' instructions are accurate: I just finished cleaning up my machine with the city's system administrator.  When the file came in, I checked the .exe file to verify that the automatic virus software had scanned it.  It had, so I went ahead and I watched the pretty fireworks, in spite of Christopher's mother's reservations to the contrary.

Then I saw Mary's alert.  Then I read Thomas' information.  All the files that Thomas' post alludes to were in place ready to go.  The key for my was that I had not yet shut down and restarted my computer, so it had not yet loaded up its nasties.  By opening 'regedit' we were able to delete the file named:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE

Because I had not yet rebooted, my WSOCK32.DLL file had not yet been patched, and did not need to be replaced.  We then deleted all the files identified by Thomas.

If you have opened the file, but not yet shut down and restarted your computer, follow the instructions in Thomas' post to remove the bad news files, and you will be spared.

So I guess for me the coast is now clear.  Christopher is right.  You can't even trust your virus software.
____________________________________

Dan Becker, Exec. Dir., RHDC
Raleigh Historic Districts Commission
[log in to unmask]

-----Original Message-----
From:   Thomas Gale [SMTP:[log in to unmask]]
Sent:   January 29, 1999 7:36 AM
To:     [log in to unmask]
Subject:        Re: "Happy99" Virus

Here is some information I got from a friend who was also apologizing
for sending along the bug.  Fortunately, I hadn't had it to open the
file yet so it was destroyed before it could do any damage to my
machine.