From: Paul F. Evans (evans@wilmington.net)
Date: Tue Mar 30 1999 - 07:55:39 EST
Braulio,
Please note that your computer has contracted the happy99.exe virus/worm
that replicates messages to all of those you e-mail with the attached file
happy99.exe. Here is something you can do.
>> This is a worm program, NOT a virus. This program has reportedly been
>> received through email spamming and USENET newsgroup posting. The file is
>> usually named HAPPY99.EXE in the email or article attachment.
>>
>> When being executed, the program also opens a window entitled "Happy New
>> Year 1999 !!" showing a firework display to disguise its other actions.
>The
>> program copies itself as SKA.EXE and extracts a DLL that it carries as
>> SKA.DLL into WINDOWS\SYSTEM directory. It also modifies WSOCK32.DLL in
>> WINDOWS\SYSTEM directory and copies the original WSOCK32.DLL into
>> WSOCK32.SKA.
>>
>> WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The
>> modification to WSOCK32.DLL allows the worm routine to be triggered when
a
>> connect or send activity is detected. When such online activity occurs,
>the
>> modified code loads the worm's SKA.DLL. This SKA.DLL creates a new email
>or
>> a new article with UUENCODED HAPPY99.EXE inserted into the email or
>article.
>> It then sends this email or posts this article.
>>
>> If WSOCK32.DLL is in use when the worm tries to modify it (i.e. a user is
>> online), the worm adds a registry entry:
>>
>>
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EX
E
>>
>> The registry entry loads the worm the next time Windows start.
>>
>>
>> Removing the worm manually:
>>
>>
>> delete WINDOWS\SYSTEM\SKA.EXE
>> delete WINDOWS\SYSTEM\SKA.DLL
>> in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK
>> in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL
>> delete the downloaded file, usually named HAPPY99.EXE
>> Windows prevents you to do step #3 and #4 above if the machine is still
>> connected to the Internet. The file "windows\system\wsock32.dll" is used
>> whenever the machine is connected to Internet (i.e. through dial-up or
LAN
>> connection).
>>
>>
>> If you are using dial-up connection (i.e. America Online), you need to do
>> the following:
>>
>>
>> terminate internet connection
>> delete WINDOWS\SYSTEM\SKA.EXE
>> delete WINDOWS\SYSTEM\SKA.DLL
>> in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK
>> in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL
>> delete the downloaded file, usually named HAPPY99.EXE
>>
>> If you are connected to Internet through LAN (i.e. in the office or cable
>> modem), you need to do the following:
>>
>>
>> >From the Start menu, select shutdown-restart in MS DOS mode
>> type CD \windows\system when DOS prompt (C:\)appears
>> type RENAME WSOCK32.DLL WSOCK32.BAK
>> type RENAME WSOCK32.SKA WSOCK32.DLL
>> type DEL SKA.EXE
>> type DEL SKA.DLL
>>
>>
>> Safe Computing:
>>
>>
>> This worm and other trojan-horse type programs demonstrate the need to
>> practice safe computing. One should not execute any executable-file
>> attachment (EXE, SHS, MS Word or MS Excel file) that comes from an email
>or
>> a newsgroup article from an untrusted source.
>>
>> Norton AntiVirus users can protect themselves from this virus by
>downloading
>> the current virus definitions either through LiveUpdate or from the
>> following webpage:
>>
This was posted to B-Greek sometime back, but this is the first time I have
seen anyone's mail infected.
Paul & Loala Evans
Wilmington First Pentecostal Holiness Church
E-mail: evans@wilmington.net
loala@wilmington.net
Web-page: http://wilmingtonfirst.churches.wilmington.org/
Pentecostal Theology Discussion List
To Subscribe: pentheology-subscribe@egroups.com
-----Original Message-----
From: Braulio Barillas <parakal@quetzal.net>
To: Biblical Greek <b-greek@franklin.oit.unc.edu>
Date: Monday, March 29, 1999 11:21 PM
Subject: RV: Heb.11:1 in English
--- B-Greek home page: http://sunsite.unc.edu/bgreek You are currently subscribed to b-greek as: [cwconrad@artsci.wustl.edu] To unsubscribe, forward this message to leave-b-greek-329W@franklin.oit.unc.edu To subscribe, send a message to subscribe-b-greek@franklin.oit.unc.edu
This archive was generated by hypermail 2.1.4 : Sat Apr 20 2002 - 15:40:21 EDT