Very easy <A HREF="http://www.pspl.com/trojan_info/win32/happy99.htm"><A HREF="http://www.pspl.com/trojan_info/win32/happy99.htm</A">http://www.pspl.com/trojan_info/win32/happy99.htm</A</A>> (complete instructions) in breaf do tthe following  Removing happy99 from your computer: You can remove this trojan from your computer by using Protector Plus antivirus software. Click here to download a 30 day Evaluation Copy of Protector Plus for your operating system. You can also remove this trojan manually from your computer. To do that, first check the WINDOWS\SYTEM folder for the presence of these files. 1. SKA.EXE 2. SKA.DLL 3. WSOCK32.SKA If you find these files then you have been attacked by the Happy99 Trojan. To remove this trojan do the following: 1. Delete SKA.EXE, SKA.DLL and WSOCK32.DLL 2. Rename WSOCK32.SKA as WSOCK32.DLL Make sure that you have WSOCK32.SKA file before deleting WSOCK32.DLL and ensure that you have renamed this file properly. You may have to close your Browser, Email software, etc. to delete and rename the DLL files. You will have to use an antivirus software capable of detecting this trojan to ensure that you do not have this file anywhere in your hard disk. You can use Protector Plus for that purpose. At 12:20 PM 2/11/1999 +0200, you wrote:

Hi Samy,

Thanks for the warning. I didn't run it as I never run executables that I receive without asking for them.

Unfortunately at least 2 users in our network received them from other sources and ran them, so their machines are now infected. I'm guessing that you were infected and managed to clear it before sending your warning. If so I would greatly appreciate it if you would let me know how you got it out of your system.

Thanks. --- Steve Crane stevec@datapro.co.za <A HREF="http://www.datapro.co.za/~stevec"><A HREF="http://www.datapro.co.za/~stevec</A">http://www.datapro.co.za/~stevec</A</A>>

...

Do not execute Happy99.exe, it will infect your system with a WORM virus. Make sure to delete the files ska.dll and ska.exe from your system (search you all directory locations under your windows directory) otherwise you will be infected the next time you re-boot (Windows and NT users only).

- To get out of this list, please send email to majordomo@suse.com with this text in its body: unsubscribe suse-linux-e Check out the SuSE-FAQ at <A HREF="http://www.suse.com/Support/Doku/FAQ/"><A HREF="http://www.suse.com/Support/Doku/FAQ/</A">http://www.suse.com/Support/Doku/FAQ/</A</A>> and the archiv at <A HREF="http://www.suse.com/Mailinglists/suse-linux-e/index.html"><A HREF="http://www.suse.com/Mailinglists/suse-linux-e/index.html</A">http://www.suse.com/Mailinglists/suse-linux-e/index.html</A</A>>