Removing Happy99.exe (ska) virus

August 19, 2009 at 1:32 pm Leave a comment

This Happy99.exe (ska) virus or worm as it is better described, This worm is attached to newsgroup and e-mail messages as an attachment called Happy99.exe. You cannot get infected with this virus just by reading a newsgroup or e-mail message. You have to execute the attachment by opening it. Generally, the person who sent it does not know that they are sending it out. If you didnt execute the attachment, you can just delete it and move on. If you execute an infected attachment, it will display a firework display, once its been activated every email you send will have the file attached. When someone else opens it, the virus spreads and the destruction continues.

Manual Removal of Happy99.exe

Steps marked optional are not absolutely necessary and are completely safe to skip. If youre not comfortable with DOS, get someone knowledgable to help you with this. I cannot make guarantees of perfect safety since its a manual removal, Perform these at your own risk. If you have Windows NT, you dont have to follow the removal steps.

1. Click Start, then Shut Down, then “Restart Computer in MS-DOS mode”, then click Yes. Its important to exit Windows in order to be able to replace the file WSOCK32.DLL which Windows normally has in use.

2.At the DOS prompt type this exactly and press enter at the end of each line:


3. Delete SKA.EXE and SKA.DLL by typing


If you get “File not found” youre either not infected or in the wrong directory. Make sure youre in your Windows System directory; check to see if you followed step 2 exactly.

4.Copy WSOCK32.SKA to WSOCK32.DLL by typing


Answer “Yes” if it asks if you want to overwrite WSOCK32.DLL.

WSOCK32.SKA is a backup of the original WSOCK32.DLL. You are replacing the modified DLL with the original. If you get a “Sharing violation” make sure you followed step 1.

5.Optional Delete WSOCK32.SKA by typing


You can leave WSOCK32.SKA on your system. It is a copy of your original WSOCK32.DLL Do not delete WSOCK32.SKA if you are unable to replace WSOCK32.DLL with WSOCK32.SKA.

6.Return to Windows by typing


7.Optional Delete Windows Registry Key.
Click Start, then Run, then type regedit in the text box, then click OK. Click HKEY_LOCAL_MACHINE, then Software, then Microsoft, then Windows, then CurrentVersion. Under RunOnce check for SKA.EXE and select it if it is there. Press delete and then click Yes. Close Regedit. Dont change anything else without making a backup of the registry first. If you dont find SKA.EXE in the registry, it doesnt mean youre not infected. SKA.EXE is only added to the registry if HAPPY99.EXE is unable to modify WSOCK32.DLL when you run it. Also, youll only find it in the registry if you havent rebooted since you ran HAPPY99.EXE.

8.Optional Choose Start, Programs, Accessories, Notepad, choose File, then Open then type C:WINDOWSSYSTEMLISTE.SKA in the File Name box. Warn the people on the list, then delete LISTE.SKA. Make it clear to the people you warn that they wont be infected unless they ran happy99.exe, to avoid alarming them unnecessarily. If you havent sent out any infected e-mails, there wont be a LISTE.SKA.

9. Optional Delete the HAPPY99.EXE file. The location of HAPPY99.EXE will vary depending on where you saved it. You can delete it simply by dragging it to the Recycle Bin from within Windows or whatever method you prefer. You may still have some messages with HAPPY99.EXE attached in your mailbox. These cannot do anything unless you run them. You can delete them if you want to or just ignore them. 10.Optional If you arent sure whether WSOCK32.DLL is infected, choose Start, then Find, then “Files or Folders”. Then type WSOCK32.DLL in the “Named” box. In the “Look in” box choose drive C: or whatever drive you have Windows on. In the “Containing Text” box type “ska.dll” without the quotes. Then click “Find Now”. If you dont find any files, that means that wsock32.dll isnt the modified version. If you dont have the modified WSOCK32.DLL, the virus has no way to attach to e-mails, even if you have SKA.EXE, SKA.DLL, and WSOCK32.SKA in the Windows System folder. If you have SKA.EXE in the RunOnce registry section, and you havent deleted SKA.EXE, then the virus will try to modify WSOCK32.DLL the next time you restart the computer.

Make sure you type the instructions exactly including spaces and punctuation. You might want to print out the removal instructions so you have something to refer to. If youre having trouble with the DOS commands, get a local person to help you with them. Its hard to know exactly how youre typing the DOS commands and what your exact situation is without seeing it in person.


Entry filed under: Antispam.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

Trackback this post  |  Subscribe to the comments via RSS Feed


  • 137,319 hits

من محتويات الموقع

كثرت إصدارات الماسنجر وتبعثرت بتشاتها وبرامجها .. فالبعض يبحث عن جديد الماسنجر .. والبحض يبحث عن ماسنجر 7.5 .. ماسنجر هوتميل والبعض يبحث عن ماسنجر 7 نحن نوجهك إلى تحميل برنامج ماسنجر بلس مسنجر 9 برنامج الماسنجر الجديد هوتميل تسعة ... برنامج ماسنجر هوتميل بلس لاصدار ماسنجر لايف 9 ماسنجر,ماسنجر بلص,تحميل الماسنجر,ماسنجر 8,صور ماسنجر,اصدارات الماسنجر و ما قبله من اصدارات.. تحميل مسنجر مسنجر بلس مسنجر 9 مسنجر ياهو مسنجر لايف تنزيل مسنجر messenger اقلاع سوفت messenger + msn + hotmail download msn messenger hotmail msn web messenger hotmail msn messenger without hotmail msn messenger und hotmail telecharger msn messenger hotmail msn hotmail messenger mac Internet turbo 2009 ,جديد البرامج و الإنترنات , ,Download parameg FOR MOBILE TORRENT ,كشف الملفات التالفه في الويندوز ,فضل برنامج للصور المتحركة عربي ,فتح محطات ART الفضائية ,Firefox ,برامج تشغيل الملفات ,تحميل أقوى مشغل ملفات flv ,تحميل برنامج مجانا internet download manager ,Fotos+do+sound+forge ,NLite ,كول اديت ,Free arc لفك الضغط ,تنزيل ساعة على سطح مكتب الكمبيوتر ,برنامج تحويل الفيديو يوتيوب الى 3gp ,تنزيل برنامج لفتح الاناشيد ,Fotos+do+sound+forge ,برامج كمبيوتر للفيروسات ,Six free mp3 ,تحويل pdf الي word ,نوع الفيديو للبرو جولد ,تحميل برنامج Passware Kit Enterprise ليش نسخة Demo ,Ares+tube ,Image banner maker ,Kmp 2007 ,تنزيل برنامج لتشغيل اناشيد mp3 ,برنامج مشاهدة القنوات الفضائية ,موقع تحميل الانتي فايروس 2010 ,تنزيل المتصفحات الجديدة ,Download free Revo Uninstaller ,تشغيل كاميرا nokia pc suite ,Zib password remova l برنامج ,تحميل برامج تشغيل الفيديو ,تحميل برنامج عن طريق الجوال لمشاهده التلفزيون ,افلام يوتيوب للهاتف المحمول مجانا ,تسريع الانترنت ,Ares+tube ,برامج حماية من الفيروسات مجانية ,Antivir free download ,برامج نت ,كيفية التعامل مع الملفات المضغوطة ,كول اديت ,Kis key ,برنامج الالة الحاسبة ,برنامج تغيير الأصوات للكمبيوتر من برامج نت ,برامج مشغلات الفيدبو كمبيوتر ,برنامج youtube لنوكيا 73

%d bloggers like this: