Win95:Ska (also known as Happy99)

is more a computer worm than a virus. It comes to a computer via an e-mail or newsgroup attachment called Hapy99.exe (10000 bytes long). It is able to infect computers on which the attachment was executed. In this case Happy99.exe puts up a fireworks window, which the computer user might like. However, while the fireworks burst on-screen, the computer worm modifies the wsock32.dll file in order to monitor what e-mails and postings are sent from the machine. It copies itself as SKA.EXE into Windows system directory and puts another file SKA.DLL (8192 bytes long) into the same directory. All Internet access goes through the wsock32.dll file. Afterwards, Happy99.exe spams the newsgroup or e-mail recipient with copies of itself any time the computer user tries to send a message across the Internet. There are several visible strings inside the virus body, namely "begin 644 Happy99.exe" and "Happy New Year 1999 !!" To remove the virus from the computer first delete the follwoing files from your SYSTEM directory: SKA.EXE, SKA.DLL and WSOCK32.DLL and then rename the file WSOCK32.SKA to WSOCK32.DLL (this is the original file renamed by virus itself).