Happy99 Detection and Removal

The Happy99 virus/worm/trojan is attached to newsgroup and e-mail messages as an attachment called Happy99.exe. You cannot get infected with this virus just by reading a newsgroup or e-mail message. You have to execute the attachment. Almost always, the person who sent it does not know that they are sending it out. It does not show up in their Outbox. If you didn't execute the attachment, you can just delete it and move on. If you execute an infected attachment, it will display a firework display. This virus does not affect Macs, DOS, Windows 3.x, OS/2, Linux or WebTV.

If you have already run Happy99.exe, to get rid of it, print out this page and follow the instructions. I have tried to make it as simple as possible so that even if you are computer illiterate, you can safely clean your system of the virus. However, please follow these steps carefully and in order. Some of the steps are optional and are so indicated.

Failure to follow instructions EXACTLY may cause problems in accessing the internet or email from your computer! I make or imply no guarantees. If you choose to use the information here, it is of your own free will. You are solely responsible for the care of your computer. If you do not feel comfortable with your level of knowledge, or your ability to accurately follow these procedures, contact a local computer technician. For further information about the virus, check out Win32/Ska virus spreads via internet .

  1. Open your Windows\System folder and find the following files:
    • ska (or ska.exe in MS-DOS)
    • ska.dll
  2. Delete these files. If you cannot find them, be sure that you go to "View" on the menu across the top of the screen. Select "options". Then click on "View all files". That should allow you to see the files.
  3. *OPTIONAL* Delete all messages in your email program with the Happy99.exe attachment. Be sure to check your trash folder and empty the trash also.
  4. If you have restarted your computer after running the Happy99.exe program, it will have created a file called "liste.ska" in the Windows\System folder. It creates a list of email addresses and will mail the virus to those addresses. You need to delete this file.
  5. After you run the program "Happy99.exe", the first time that you restart your computer, it renames a file that is critical for your computer to access the internet. The original file name is "Wsock32.dll" and the program changes it to "Wsock32.ska". It creates a modified version and labels it "Wsock32.dll". You will want to erase the new "Wsock32.dll" and rename or copy "Wsock32.ska" to "Wsock32.dll" again. Here is how:
    • Make SURE all internet related programs are disabled (this includes instant messaging services such as ICQ and AOL Instant Message), then restart your computer in MS-DOS mode.
    • Once it has restarted, you should see "C:\WINDOWS>" on the screen.
    • Type in "cd system" and press "enter" or "return". You should see"C:\WINDOWS\SYSTEM>" on the screen. If that doesn't get you there, try "cd c:\windows\system" or "cd windows\system".
    • Type in "attrib -r wsock32.dll" and press "enter" or "return".
    • Type in "copy wsock32.ska wsock32.dll" and press "enter" or "return".
    • When asked if you want to overwrite wsock32.dll, type "y" for yes. If you get an error message, try deleting "wsock32.dll" and do step "e" again.
    • Type in "exit" and press "enter" or "return".
  6. I suggest that you notify everyone on your email list about the virus since you may have sent it to them unknowingly.
  7. *OPTIONAL* If you have followed all of the steps correctly, you may delete "wsock32.ska" safely. You may want to rename it so that you can keep it (it is an uncorrupted copy of wsock32.dll) without it being picked up by an antivirus program.

That should take care of the Happy99 virus. HOWEVER - unless you are running antivirus software with an updated data file, you could easily catch this virus again or another one. If you already have the software, you should update your data files at least monthly. Surfing the internet without antivirus software is like having sex without protection. The next virus you catch might be deadly to your computer.

For more info on this particular virus go to a story on CNN.