attachments, viruses, email, and lists

[Pengelly Pensione]

Hi Andrew,
Thanks for this.  We had in fact been infected! I went to the site you
posted and have some questions.  I hope you don't mind me asking.

"If the worm is detected in your system you can easy get rid of it just by
deleting SKA.EXE and SKA.DLL files in the system Windows directory."
Did this!

"You also should delete the WSOCK32.DLL file and replace it with WSOCK32.SKA
original file."
I found 2 WSOCK32.DLL files.  One in the directory C\windows\system where I
also found the SKA files mentioned and the other in C\winisto.400.
WSOCK32.SKA was in c\window\system.  I have set both of the DLL files to
read only.  WIN98 will not allow me to delete the .DLL from window\system
because it says it is using it.  It would allow me to delete the other but
I'm not sure I should.  Can you tell me what to do!?

"The original HAPPY99.EXE file should be also located and deleted."
LIve and learn.  I had saved it to a floppy and opened it from there
thinking that would protect me from viruses.

"The special AVP update (HAPPY.AVC database) allows to stop worm spreading
and protect your computer from attach. It is distributed for free and is
available on the AVP Web sites on the world.

Many thanks
John-the-Tuner's Wife
Helen
-----Original Message-----
From: Andrew M. Rudoff <andy@rudoff.com>
To: pianotech@bridget.rudoff.com <pianotech@bridget.rudoff.com>
Date: Sunday, February 14, 1999 7:39 AM
Subject: attachments, viruses, email, and lists


>Pianotech subscribers,
>
>There's an unusual program floating around that, if run on your machine,
>changes your machine to add the program as an attachment to your outgoing
>messages.  Someone on our list has been infected with this virus and has
>posted a message to pianotech containing an attachment called
"Happy99.exe".
>
>If you received this program, don't run it.  In fact, you should think
twice
>before running any attachment someone sends you unless you really know
>what you're doing.  On Windows and Mac systems, programs are allowed to
>vastly modify the system itself, remove or alter any file, and even install
>new versions of your existing applications without you noticing.  So
>running any random program that someone sends you is ill advised.
>
>Anyway, this particular virus only affects Windows systems, and if you
>think you've been hit, see http://www.avp.com/happy/body_happy.html
>for details on how to get rid of it.  The good news is that this virus
>is mostly just annoying.
>
>I have set the mailing list filters to attempt to catch posts with
>this attachment.
>
>Finally, I usually discourage posts to this list that contain virus
warnings,
>since often times the facts are incorrect and misleading.  If anyone
>on the list wants me to research a virus warning they've received, and
>forward it to the list if appropriate, feel free to send it to me.
>
>Any questions?  Mail me privately at andy@rudoff.com
>
>-andy
>