attachments, viruses, email, and lists

[Elian Degen]

Hi Pengelly


>Hi Andrew,
>Thanks for this.  We had in fact been infected! I went to the site you
>posted and have some questions.  I hope you don't mind me asking.
>
>"If the worm is detected in your system you can easy get rid of it just by
>deleting SKA.EXE and SKA.DLL files in the system Windows directory."
>Did this!
>
>"You also should delete the WSOCK32.DLL file and replace it with
WSOCK32.SKA
>original file."
>I found 2 WSOCK32.DLL files.  One in the directory C\windows\system where I
>also found the SKA files mentioned and the other in C\winisto.400.
>WSOCK32.SKA was in c\window\system.  I have set both of the DLL files to
>read only.  WIN98 will not allow me to delete the .DLL from window\system
>because it says it is using it.  It would allow me to delete the other but
>I'm not sure I should.  Can you tell me what to do!?


1 Set the attributes of the file to delete to normal, ( No read only, or
system)

2 Shut off the computer and start it in DOS or use a start up disk

3 Go to C:\Windows\system (  at the DOS prompt type cd windows, return - cd
system, return )

and then type del (name of the file)

That should get rid of it.

If you get any funny messages afterwards you will probably have to go into
the Win registrey and delete it also, try this way first and let me know

Elian Degen
Piano Tuner and Technician
Caracas, Venezuela  degen@telcel.net.ve
Phone 58-2-748547/ 58-14-9222981 Fax 58-2-748547





>"The original HAPPY99.EXE file should be also located and deleted."
>LIve and learn.  I had saved it to a floppy and opened it from there
>thinking that would protect me from viruses.
>
>"The special AVP update (HAPPY.AVC database) allows to stop worm spreading
>and protect your computer from attach. It is distributed for free and is
>available on the AVP Web sites on the world.
>
>Many thanks
>John-the-Tuner's Wife
>Helen
>-----Original Message-----
>From: Andrew M. Rudoff <andy@rudoff.com>
>To: pianotech@bridget.rudoff.com <pianotech@bridget.rudoff.com>
>Date: Sunday, February 14, 1999 7:39 AM
>Subject: attachments, viruses, email, and lists
>
>
>>Pianotech subscribers,
>>
>>There's an unusual program floating around that, if run on your machine,
>>changes your machine to add the program as an attachment to your outgoing
>>messages.  Someone on our list has been infected with this virus and has
>>posted a message to pianotech containing an attachment called
>"Happy99.exe".
>>
>>If you received this program, don't run it.  In fact, you should think
>twice
>>before running any attachment someone sends you unless you really know
>>what you're doing.  On Windows and Mac systems, programs are allowed to
>>vastly modify the system itself, remove or alter any file, and even
install
>>new versions of your existing applications without you noticing.  So
>>running any random program that someone sends you is ill advised.
>>
>>Anyway, this particular virus only affects Windows systems, and if you
>>think you've been hit, see http://www.avp.com/happy/body_happy.html
>>for details on how to get rid of it.  The good news is that this virus
>>is mostly just annoying.
>>
>>I have set the mailing list filters to attempt to catch posts with
>>this attachment.
>>
>>Finally, I usually discourage posts to this list that contain virus
>warnings,
>>since often times the facts are incorrect and misleading.  If anyone
>>on the list wants me to research a virus warning they've received, and
>>forward it to the list if appropriate, feel free to send it to me.
>>
>>Any questions?  Mail me privately at andy@rudoff.com
>>
>>-andy
>>
>