"Happy99.exe"<== worm-virus WARNING!!!...to all who believe it?

To whom this may concern:

        Early into 1999, someone sent out a file into pixlist/hosta-open groups
"happy99.exe" and running this file, releases a worm-virus onto your
hard-drive.
        Today, Forrest JOHNSON sent me this same file, for some unknown reason,
but that is OK, since "PIXLIST" is a free expression group, however?  

TO FORREST <== Somehow?...I missed your humor of sending, and without any
explanation as to what kind of "executable file" you send via
'happy99.exe'...and unless you can give me justifiable cause & reason, as to
why you send me this file, please be advised: you are no longer a part of
pixlist, as of this posting!
    To make this a unanimous decision?...and to any pixlisters objecting to the
deletion of our virus-sending friend, please advise me accordingly as to any
reasons why we should keep him on board (Forrest Johnson included?)?

As you may recall, some people did get hurt by "Happy99.exe" and others, had to
do many manipulations/procedures to fix & prevent disaster with their hard
drives.

EVIDENCE BELOW and to whit -- I'm gonna paste some related emails below:

Date: Sat, 06 Feb 1999 19:11:26 -0500 From: Township <township@acbm.qc.ca>
Subject: Re: Warning Sender: owner-hosta-open@mallorn.com To:
hosta-open@mallorn.com 
Looks like I may have been the one singled out! I opened and ran the file, 
then Joannes message came in with the warning! Since the puter didn't 
blow-up, I thought, wow! lucky me! Finished reading e-mail, shut down the 
puter. A little while later, started her up again, and nothing...no desktop 
( just Bobs Wallpaper in the backround) with some sort of message telling me 
there were restrictions placed on my system! Tried to get rid of this, 
rebooted....still nothing! 
Called Compaq....we tried all kinds of stuff, same results...nothing! 
BTW...MacAffee did not detect anything! Good huh! 
We tried to access some files so that I can save some personal files, ....no 
go! Had to run a "Quick Restore" which basically makes your puter like new, 
they say...fixes all and wipes out all, but reloads all software that came 
with this package! 
Now..a question...is this still going around? Like, if Denise opened and 
ran the file, was "bit" can she pass it around by sending e-mail ( sorry 
Denise, don't mean to pick on you!)? 
Bob...help! any ideas! 
Barbara 
township@acbm.qc.ca
----------------------
Date: Sat, 06 Feb 1999 21:59:54 -0600 
From: Bob <bobaxe@sbtek.net> 
Subject: virus 
Sender: owner-hosta-open@mallorn.com 
To: hosta-open@mallorn.com 
Reply-to: hosta-open@mallorn.com 
Message-id: <36BD0FBA.102C@sbtek.net> 
Organization: Hardly Any 
MIME-version: 1.0 
X-Mailer: Mozilla 3.04Gold (Win95; I) 
Content-type: text/plain; charset=us-ascii 
Content-transfer-encoding: 7bit 
Precedence: bulk 

Good evening 
I finally tried it getting rid of the virus and it seemed to work. 
First I deleted ska.dll and ska.exe which are the virus files. Then I 
restarted my computer in dos mode(which I am pretty shaky at) and typed 
in cd windows\system which will change it if you start at c:> to the 
folder where the remaining file that was modified is at. Then type in 
COPY WSOCK32.SKA WSOCK32.DLL
at the c:>windows\system> dos prompt and when it prompts you whether 
you want to overwrite type y and press enter. After that if it works it 
will say so and then type in exit and windows should come up. Here is 
where I found the info 
http://www.geocities.com/SiliconValley/Heights/3652/SKA.HTM
After this I restarted my computer and it seems to work fine. I don't 
know if I can help anyone with this but I am willing to try. You might 
as well give it a shot if you are going to have to format your hard 
drive anyway. If you go to the find function on the start menu and type 
in SKA.EXE or SKA.DLL and find you have them on your system you 
have it anyway. On second thought don't listen to me, do whatever you 
feel is right. :-) 
-- 
Bye 
Bob
Bob Axmear 208 2nd St Ne Waukon,Ia 52172-1308 319 568-4859 
http://www.hostasonline.com/ Hostasonline.com 
http://www.hostasonline.com/webwork.html WEBWORK
----
Date: Sat, 06 Feb 1999 17:01:59 -0500 
From: "Carolyn Q. Bryson" <quinnell@iquest.net> 
Subject: Re: Warning 
In-reply-to: <36BC7C23.748C@sbtek.net> 
Sender: owner-hosta-open@mallorn.com 
X-Sender: quinnell@pop.iquest.net 
To: hosta-open@mallorn.com 
Reply-to: hosta-open@mallorn.com 
Message-id: <3.0.5.32.19990206170159.00e24ac0@pop.iquest.net> 
MIME-version: 1.0 
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.5 (32) 
Content-type: text/plain; charset="us-ascii" 
Precedence: bulk 
References: <e6dacdaa.36bc700e@aol.com> <36BC732E.7569@sbtek.net> 
<36BC7834.CFE676E4@sota-oh.com> 

Thanks Bob -
Boy, it is really hard to know what to believe these days. I just updated 
my Norton Antivirus this past week, so I hope it is effective against this 
one.
Carolyn Q. Bryson, Indianapolis 
------------ 
At 11:30 AM 2/6/99 -0600, you wrote: 
>Hello everyone 
> I downloaded Norton Antivirus and ran it and it says I am infected with 
>Happy98/Worm. I will make a webpage shortly so you can see what the 
>program says. 
>Bye 
>Bob 
> It will be http://www.hostasonline.com/worm.jpg

------------- 
FINAL TO ALL:
         I've had enquiry re: how does one know if "Happy99.exe" is on one's
computer, and if the virus files "ska.exe and ska.dll" have been launched, by
running of the executable?
... AS A PRECAUTION...mouse click START...mouse click FIND...and type into the
files box, these three file-names below, re: three separate hard-drive
searches:
happy99.exe
ska.dll  
ska.exe

Anyone, who does have any of the files mentioned above: go to Bob Axmear's
email above for direction.  Most important...if you receive "happy99.exe" from
someone?...do not run it!  For that matter, DO NOT RUN ANY EXECUTABLE!!! ".exe"
file, which someone has sent you unsolicitated and without any explanation as
to what it will do <== I believe, this is a good unwritten rule to follow? 

TO ALL: I personally, will not stand for anyone sending an "executable file" to
any computer, without their giving full expanation as what the file is supposed
to show & do.

To Forrest Johnson <== I'd like to ask:
WHAT ARE U UP TO?
--------------------



the'SHADOW'gardener
funkia'LOVE'dove
aka/email: "William Nash" <raffi@sympatico.ca>
LETTERMAIL: 157 Harvard Road, Guelph, Ontario, CA N1G4L3 Tel:(519-767-1221) 
Ontario Hosta Society (OHS) website URL:
http://www.geocities.com/PicketFence/Garden/1555/
OHS related EMAIL:  "John Kee" <junk@aztec-net.com>
Personal website URL = http://www3.sympatico.ca/raffi/

---------------------------------------------------------------------
To sign-off this list, send email to majordomo@mallorn.com with the
message text UNSUBSCRIBE HOSTA-OPEN
Other Mailing lists | Author Index | Date Index | Subject Index | Thread Index