Good evening

Ok you did good so far...  all you have left to do is Disconnect from the
internet and close all internet related applications  www/ftp/icq/irc/email
everything...  once you have done that  you need to do a find for wsock32.*
   you will most likely find two files  the infected one  labeled
wsock32.dll  and the backup the happy99 so thoughtfully made for you it
will be listed as  wsock32.ska... simply delete the wsock32.dll (infected
file)  and rename wsock32.ska to wsock32.dll   reboot and your all set...

You may also want to do a find for list*.ska   if you find this file  you
can open it with notepad listed will be all the email addresses happy99
sent itself too and you should inform those users of possible infection as
well

Hope that help some

Christy Duncan

***********

On 3/17/00 at 2:52 PM Paul Tiwana wrote:

>Hi friends,
>
>PC-Cillin showed six files in my my friend's computer affected with the
virus.
>1. Happy99.exe
>2. Line.gif
>3. SKA.vir
>4. SKA.dll
>5. SKA.exe
>6. wsock32.dll
>I  deleted  first five of them as I knew they were not important.
>I m reluctant to delete wsock32.dll . I m afraid it may not affect the
working of the computer if it is deleted.
>Please advise
>

~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~
Forever trust in who you are... and nothing else matters!

      "Hold No Punches.." Rode brings you great shareware/freeware
        programs with his honest opinions in this weekly column.
                         http://nospin.com/rode