Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Action
- Summary
- Action
- More Information
Please read the instructions for removing infected executable files.
When you have run a scan to remove the virus files, delete SKA.EXE, SKA.DLL, WSOCK32.DLL if they have not already been deleted. Then rename WSOCK32.SKA to WSOCK32.DLL.
The file LISTE.SKA will contain the email addresses to which W32/SKA-Happy99 has sent itself. You may wish to warn these users. Then delete LISTE.SKA.
More Information
This virus modifies wsock32.dll, so that when an email is sent, a second message containing the virus is sent also. The virus will also drop ska.exe and ska.dll. If you find the virus in ska.exe, ska.dll or Happy99.exe, we recommend running SWEEP again in Full Mode to detect changes in wsock32.dll.
The virus also copies the original wsock32.dll to wsock32.ska. It creates the file liste.ska which is a list of the mail addresses to which Happy99.exe is sent. It uses liste.ska to ensure that it mails Happy99.exe to each address only once.
When triggered W32/Ska-Happy99 displays a fireworks effect with the message "Happy New Year 1999".
The virus was written by the French virus writer, Spanska.
|
