Top of iNet Over Matter
iNet Over Matter - Virus Info- Happy99
Internet Computing - Tech Support
An Internet Resource Page
by: Bob in HoustonEmail
 Happy99.exe Worm
NOTES
    Problems sending email may be caused by having executed the happy99 worm, which effects the winsock file in order to automatically redistribute itself.

For instructions to determine if you have and how to remove HAPPY99.EXE, see these references:
Ska Virus Web Site - Explains how to identify and get rid of happy99 http://www.geocities.com/SiliconValley/Heights/3652/SKA.HTM
  --------------------------------------------
    Other helpful sites
http://www.pspl.com/faqs/happyfaq.htm
http://www.symantec.com/avcenter/venc/data/happy99.worm.html
which provides an online tool to help clean up. See the instructions.

------------------------------------ 
from http://www.sarc.com/avcenter/venc/data/happy99.worm.html

Removing the Worm Manually - Step by Step
1.. delete WINDOWS\SYSTEM\SKA.EXE 
2.. delete WINDOWS\SYSTEM\SKA.DLL 
3.. in WINDOWS\SYSTEM\ directory, 
rename WSOCK32.DLL to WSOCK32.BAK 
4.. in WINDOWS\SYSTEM\ directory, 
rename WSOCK32.SKA to WSOCK32.DLL 
5.. delete the downloaded file, usually named HAPPY99.EXE 
 Windows prevents you to do step #3 and #4 above if the machine is still connected to the Internet. The file "windows\system\wsock32.dll" is used whenever the machine is connected to Internet (i.e. through dial-up or LAN connection).

If you are using dial-up connection (i.e. you are on line), you need to do the following:
1.. terminate internet connection 
2.. delete WINDOWS\SYSTEM\SKA.EXE 
3.. delete WINDOWS\SYSTEM\SKA.DLL 
4.. in WINDOWS\SYSTEM\ directory, 
rename WSOCK32.DLL to WSOCK32.BAK 
5.. in WINDOWS\SYSTEM\ directory, 
rename WSOCK32.SKA to WSOCK32.DLL 
6.. delete the downloaded file, usually named HAPPY99.EXE

If you are connected to Internet through LAN (i.e. in the office or cable modem), you need to do the following:
1.. From the Start menu, select shutdown/restart in MS DOS mode 
2.. type CD \windows\system when DOS prompt (C:\)appears 
3.. type RENAME WSOCK32.DLL WSOCK32.BAK 
4.. type RENAME WSOCK32.SKA WSOCK32.DLL 
5.. type DEL SKA.EXE 
6.. type DEL SKA.DLL