[WEB4LIB] virus

[Karen Harker]

Another listserv, doublereed-l, had the same go around with the same virus.  Luckily, few people opened the unusual looking attachment.



Karen R. Harker
Web Developer
UT Southwestern Medical Library
5323 Harry Hines Blvd.
Dallas, TX  75235-9049
http://www.swmed.edu/home_pages/library/

>>> Steve Hooley <hooleyss at gsaix2.cc.gasou.edu> 2/11/99 3:37:32 PM >>>
	We just had a go-round with a nasty virus/worm called HAPPY99.exe. It
hitchhikes on email, with the result that an infected machine was used to
post to our internal listserv. You get the original mail, plus a second
message with the same header with the HAPPY99.EXE attached. When run, it
displays pretty fireworks while dropping ska.exe and ska.dll in your system
directory and it makes a copy of wsock32.dll called wsock32.ska. If you
don't reboot, you can just delete these files - if you reboot it patches
wsock32.dll and begins mailing itself around. We found it mentioned several
places, for example:
http://beta.nai.com/public/datafiles/valerts/vinfo/w32ska.htm 
	and it's not destructive, but is it ever annoying! If it gets you, replace
wsock32.dll and delete the happy99.exe from your attachments. I thought it
was an isolated case until another one showed from an unrelated source this
morning, so maybe it's going around.

Steve Hooley - Technician
Zach S. Henderson Library
Georgia Southern University 
 www2.gasou.edu/facstaff/hooleyss
"You see, I don't believe that libraries should be
 drab places where people sit in silence, and that's
 been the main reason for our policy of employing
 wild animals as librarians."  --Monty Python