For Windows users :: HAPPY99 is dangerous

[Bill Ries-Knight <brk@slip.net>]

I was recently infected with the HAPPY99.EXE aka W32/SKA virus.  It has
cost me access to one maillist, as well as much frustration.
As it infects only Windows systems, I doubt if any of y'all have had an
issue.  If you have good software available, it apparently leaves a
signature in the outgoing header <X-Spanska: Yes>.  Good Luck.

Below is a narrative I want to pass along.

I have used Macafee AntiVirus since 1988 or 1989, and this is the first
time I have NOT caught a virus before creating havoc.  My data files
were out of date as I had just restored my system following a crash.
The worm was sent to me from a vendor in much the same way it was sent
to the newsgroup.  The vendor sent me an email with an attachment; this
is the brief header.
From:         Matt Trantham <mtrantham@cablesun.com>  Fri 11:19 AM
Subject:    New Products
To:             brk@slip.net

This email was followed by another with the same header etc; the only
difference was the subject HAPPY99.  It also had a single attachment
titled HAPPY99.EXE.

As I receive several little doodads from many of my clients and vendors
each week, I thought nothing of it.  I opened the attachment and got a
window with aerial fireworks.  I went about with my business.

A few hours later I rebooted Win98 (at least 3x a day for my
system....What a Pain) and went online.  The first and only posting was
for the blt maillist.  Later that night I rechecked my e-mail and
discovered your message.  At first I thought it was a joke - lots of
email floats around titled "you have a virus."  A few moments later I
found it was not so.  I followed the instructions you offered and made
the corrections indicated.

What I found about this devious program is it has one objective once it
infects your system. To replicate by shadowing your email program and
sending itself via email to every recipient as you send new messages.

By design, it ONLY affects Windoze machines, and it is IMPOSSIBLE to
perceive its activity.  Two things we can do, BE AWARE of it and update
your virus data files, posthaste.

Here are some additional links to browse.

How to check if your computer has been infected with the wide-spread
"Happy99" worm
http://www.antima.com/worms.htm

Happy99.exe Worm Virus doesn't make for Happy Computing
http://www.e-musicbox.com/happy99virus.htm

Macafee,  aka Network Associates aka: NAI  aka A.V.E.R.T.
http://www.avertlabs.com/public/datafiles/valerts/vinfo/w32ska.asp

Symantec, aka Norton AntiVirus
http://www.symantec.com/avcenter/venc/data/happy99.worm.html