"Virus" sent to propagation list
- To: b*@nwinternet.com
- Subject: "Virus" sent to propagation list
- From: "* P* L* <lindsey@mallorn.com>
- Date: Mon, 1 Mar 1999 01:14:28 -0600 (CST)
Hi Neil,
It looks like your system is infected by a trojan horse called
HAPPY.EXE, and tried to send a copy of itself to the propagation
mailing list as an attachment. At some point you probably ran
a program under the same name and saw a nice fireworks display
on your monitor, but it also infected your system.
Fortunately, the filters in place on the Mallorn servers caught the
message before it was sent out to everyone, so no harm was done.
However, any messages that you send to other lists or people not at
Mallorn will probably get through.
There's some instructions on removing the trojan horse at:
http://www.pspl.com/trojan_info/win32/happy99.htm
"You can also remove this trojan manually from your computer. To
do that, first check the WINDOWS\SYTEM folder for the presence
of these files.
1. SKA.EXE
2. SKA.DLL
3. WSOCK32.SKA
If you find these files then you have been attacked by the
Happy99 Trojan. To remove this trojan do the following:
1. Delete SKA.EXE, SKA.DLL and WSOCK32.DLL
2. Rename WSOCK32.SKA as WSOCK32.DLL
Make sure that you have WSOCK32.SKA file before deleting
WSOCK32.DLL and ensure that you have renamed this file
properly. You may have to close your Browser, Email software,
etc. to delete and rename the DLL files."
The above URL also provides more detailed information about
the actual trojan horse (if you care about that kind of thing).
Chris
P.S. I'm Cc:'ing this to the propagation list so that others who may
run into this know what's going on. The moral of the story is
to never run attachments that someone sends you unless you trust
that person implicitly AND they've told you that they're sending
you an attachment in their message. If you're not sure, send
them a message back asking if they meant to send you an
attachment.
---------------------------------------------------------------------
To sign-off this list, send email to majordomo@mallorn.com with the
message text UNSUBSCRIBE PROPAGATION