Greetings, Frank & Sue & others--
----- Original Message -----
From: Frank &Sue Schmaltz <[log in to unmask]>

> Have been trying to get rid of Happy99 worm. Directions
for removing
> worm include renaming two files -- WSOCK32.DLL to
WSOCK32.BAK
>                                 WSOCK32.SKA to WSOCK32.DLL
> Anti-virus program removed or changed everything but
WSOCK32.DLL but
> program (Windows 95) will not let me change it (I was no
longer
> connected to the internet). Happy99 itself is no longer in
the system.

Not knowing if you carried out a "full cleanup", I can't be
certain.  According to the Symantec
web site (Norton Antivirus, etc.), you need to delete
ska.exe and ska.dll, as well as take the
steps noted above.  When I attempted this repair, I found it
necessary to boot to a command
prompt, attrib -s -r wsock32.*, then carry out the steps you
mentioned.  If you have been unable
to change wsock32.dll, happy is still mostly there.  This
dll is what attaches happy to your out-
going e-mail.  I recommend you do the following:

Boot with your Win95 startup disk (It should have attrib on
it)
At the a:\ prompt type attrib -s -r
c:\windows\system\wsock32.*
[From the Symantec site instructions]
Delete WINDOWS\SYSTEM\SKA.EXE
Delete WINDOWS\SYSTEM\SKA.DLL
In c:\WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to
WSOCK32.BAK
In c:\WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to
WSOCK32.DLL
Delete the downloaded file, usually named HAPPY99.EXE

To add a bit of protection, at the a:\ prompt type attrib +r
c:\windows\system\wsock32.dll.
This will make the file read-only, which should prevent
happy from modifying it again.

HTH,

Paul A. Shippert [log in to unmask] Library/Media
Specialist
"There is a theory which states that, if ever anyone
discovers exactly
what the universe is for and why it is here, it will
instantly disappear
and be replaced by something even more bizarre and
inexplicable.
There is another theory which states that this has already
happened." Douglas Adams

                PCSOFT mailing list is brought to you by:
                         The NOSPIN Group, Inc.
                  http://nospin.com - http://nospin.org