Subject: [Admin] Re: [FFML] [DBZ/SM] The voices in my head won't stop...
From:
Date: 2/16/1999, 10:53 PM
To: Tybalt , ffml@fanfic.com


Actually, it doesn't appear that the binary posting was intentional.
There is a worm travelling the internet by the name of happy99.exe .
To quote the Symantec Anti-virus Research Center site:

# When being executed, the program also opens a window entitled "Happy
# New Year 1999 !!"  showing a firework display to disguise its other
# actions. The program copies itself as SKA.EXE and extracts a DLL
# that it carries as SKA.DLL into WINDOWS\SYSTEM directory. It also
# modifies WSOCK32.DLL in WINDOWS\SYSTEM directory and copies the
# original WSOCK32.DLL into WSOCK32.SKA.

# WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The
# modification to WSOCK32.DLL allows the worm routine to be triggered
# when a connect or send activity is detected. When such online
# activity occurs, the modified code loads the worm's SKA.DLL. This
# SKA.DLL creates a new email or a new article with UUENCODED
# HAPPY99.EXE inserted into the email or article. It then sends this
# email or posts this article.

More information is at 
http://www.symantec.com/avcenter/venc/data/happy99.worm.html ,
including how to remove the worm manually.  

(Disclaimer: one does not work for Symantec or speak for them.)

Hopes this helps anyone...

-- Jeffery "Taper" Wickel jtwickel@nyx.net ------------------------------------------------------------------ Q: What's the difference between USL and the Titanic? A: The Titanic had a band.