virus

[Steve Hooley]

	We just had a go-round with a nasty virus/worm called HAPPY99.exe. It
hitchhikes on email, with the result that an infected machine was used to
post to our internal listserv. You get the original mail, plus a second
message with the same header with the HAPPY99.EXE attached. When run, it
displays pretty fireworks while dropping ska.exe and ska.dll in your system
directory and it makes a copy of wsock32.dll called wsock32.ska. If you
don't reboot, you can just delete these files - if you reboot it patches
wsock32.dll and begins mailing itself around. We found it mentioned several
places, for example:
http://beta.nai.com/public/datafiles/valerts/vinfo/w32ska.htm
	and it's not destructive, but is it ever annoying! If it gets you, replace
wsock32.dll and delete the happy99.exe from your attachments. I thought it
was an isolated case until another one showed from an unrelated source this
morning, so maybe it's going around.

Steve Hooley - Technician
Zach S. Henderson Library
Georgia Southern University 
 www2.gasou.edu/facstaff/hooleyss
"You see, I don't believe that libraries should be
 drab places where people sit in silence, and that's
 been the main reason for our policy of employing
 wild animals as librarians."  --Monty Python