x
Almost there! Please complete this form and click the button below to gain instant access.
EliteFitness.com FREE Email Series: How You Can Use Winstrol, Masteron, HGH, and Testosterone for a Perfect, Muscular Physique!
- -
We hate SPAM and promise to keep your email address safe.
- -


UBBFriend: Email This Page to Someone!
  George Spellwin's ELITE FITNESS Discussion Boards
   Anabolic Discussion Board
  off topic- happy virus

Post New Topic  
profile | register | preferences | faq | search

Author Topic:   off topic- happy virus
macrophage69alpha
Pro Bodybuilder
(Total posts: 774)
posted March 03, 2000 06:08 PM     Click Here to See the Profile for macrophage69alpha   Click Here to Email macrophage69alpha     Edit/Delete Message
I just recieved an E mail that was piggybacked to another from the sender- it was all code- except at the top where it said

happy.exe

is this the "happy" virus

i think that it did not work because I accesed it on Hushmail and their server has some interesting security measures. anyways if anyone has any info I appreciate it.

BTW- texas guns it was piggybacked on your E mail- did you send it directly or did you use the built in mail feature on the board?

------------------
MP

[This message has been edited by macrophage69alpha (edited March 03, 2000).]

IP: Logged

DRRman
Amateur Bodybuilder
(Total posts: 8)
posted March 03, 2000 06:53 PM     Click Here to See the Profile for DRRman   Click Here to Email DRRman     Edit/Delete Message
hey man, that virus is not malicious, and he probably didn't send it, it just automatically forwarded itself to the people in his address book, i would delete the file, and run a good virus scan on the computer you are on.

IP: Logged

quenepo
Pro Bodybuilder
(Total posts: 239)
posted March 03, 2000 07:06 PM     Click Here to See the Profile for quenepo   Click Here to Email quenepo     Edit/Delete Message
I recived that virus, thank god I have norton.


quenepo

IP: Logged

dogboy
Amateur Bodybuilder
(Total posts: 70)
posted March 03, 2000 07:42 PM     Click Here to See the Profile for dogboy   Click Here to Email dogboy     Edit/Delete Message UIN: 66354862
It is pretty harmless. It did not infect you unless you used the file. It e-mails itself to everyone on your contact list. Any updated virus software gets rid of it with ease. Be suspicious of any *.exe file sent through e-mail. Lots of trojans and stuff like that...

IP: Logged

E2
Pro Bodybuilder
(Total posts: 1224)
posted March 03, 2000 07:47 PM     Click Here to See the Profile for E2   Click Here to Email E2     Edit/Delete Message UIN: 54337564
Yeah mac she accidentally sent it to me to, i mailed her about it. A few people on the board have it.

IP: Logged

WCP
Pro Bodybuilder
(Total posts: 273)
posted March 04, 2000 03:04 AM     Click Here to See the Profile for WCP   Click Here to Email WCP     Edit/Delete Message
The happy.exe virus in not a auto forward type of virus, if there is one like that its news to me. Its a typical worm virus that attaches to memory and dicks mainly with word and office documents i.e speadsheets, databases..etc.
Someone I may or may not know likes to fiddle with writing these little ditties for shits and giggles, and is very familear with this virus.
It often come accustomed with a cute fireworks display and sometimes dont. Again it is not like the Melissa virus to the best of my knowledge and self forwarding, but will attach itself to mail sent out, and "piggy back"
A good clean sweep with an updated anti virus application should take care of it.
If not sweep your system registery and see if you can clear it from there.
Its nothing killer but a pain in the ass no less, ha,ha....nothing compared to Raid though...
Later Bros.

------------------
"the man who can defeat himself, is truly the greatest warrior"

IP: Logged

dogboy
Amateur Bodybuilder
(Total posts: 70)
posted March 04, 2000 03:55 PM     Click Here to See the Profile for dogboy   Click Here to Email dogboy     Edit/Delete Message UIN: 66354862
I encountered the Happy99.exe

IP: Logged

Rock_Man
Pro Bodybuilder
(Total posts: 321)
posted March 08, 2000 03:01 PM     Click Here to See the Profile for Rock_Man   Click Here to Email Rock_Man     Edit/Delete Message UIN: 8696614
This is a worm program, NOT a virus. This program has reportedly been received through email spamming and USENET newsgroup posting. The file is usually named HAPPY99.EXE in the email or article attachment.

When being executed, the program also opens a window entitled "Happy New Year 1999 !!" showing a firework display to disguise its other actions. The program copies itself as SKA.EXE and extracts a DLL that it carries as SKA.DLL into WINDOWS\SYSTEM directory. It also modifies WSOCK32.DLL in WINDOWS\SYSTEM directory and copies the original WSOCK32.DLL into WSOCK32.SKA.

WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The modification to WSOCK32.DLL allows the worm routine to be triggered when a connect or send activity is detected. When such online activity occurs, the modified code loads the worm's SKA.DLL. This SKA.DLL creates a new email or a new article with UUENCODED HAPPY99.EXE inserted into the email or article. It then sends this email or posts this article.

If WSOCK32.DLL is in use when the worm tries to modify it (i.e. a user is online), the worm adds a registry entry:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunOnce=SKA.EXE

The registry entry loads the worm the next time Windows start.

Removing the Worm Manually


1 delete WINDOWS\SYSTEM\SKA.EXE
2 delete WINDOWS\SYSTEM\SKA.DLL
3 in WINDOWS\SYSTEM\ directory,
4 rename WSOCK32.DLL to WSOCK32.BAK
5 in WINDOWS\SYSTEM\ directory,
6 rename WSOCK32.SKA to WSOCK32.DLL
7 delete the downloaded file,
usually named HAPPY99.EXE
Windows prevents you to do step #3 and #4 above if the machine is still connected to the Internet. The file "windows\system\wsock32.dll" is used whenever the machine is connected to Internet (i.e. through dial-up or LAN connection).


If you are using dial-up connection (i.e. America Online), you need to do the following:


1 terminate internet connection
2 delete WINDOWS\SYSTEM\SKA.EXE
3 delete WINDOWS\SYSTEM\SKA.DLL
4 in WINDOWS\SYSTEM\ directory,
5 rename WSOCK32.DLL to WSOCK32.BAK
6 in WINDOWS\SYSTEM\ directory,
7 rename WSOCK32.SKA to WSOCK32.DLL
delete the downloaded file,
usually named HAPPY99.EXE

------------------
Rock On!

IP: Logged

Capt'n_Crunch
Amateur Bodybuilder
(Total posts: 18)
posted March 08, 2000 06:24 PM     Click Here to See the Profile for Capt'n_Crunch   Click Here to Email Capt'n_Crunch     Edit/Delete Message
Its just a worm that replicates itself. When you open the file you see a fireworks display, meanwhile it alters your winsock32.dll file. Then each time you initiate your email or newsgroup, it spams the newsgroup or email recipient with copies of itself. It wont hurt data on your comp, its more of a nuisance for networks and their administrators. It can slow down networks and crash email servers so its not really too terrible on you, jus inoculate it, delete it, or fix it if your already infected. If you didnt see that fireworks display, I wouldnt worry about it, jus run scan.

IP: Logged

big_bad_buff
Pro Bodybuilder
(Total posts: 241)
posted March 08, 2000 06:56 PM     Click Here to See the Profile for big_bad_buff   Click Here to Email big_bad_buff     Edit/Delete Message

could be a trojan!. you can send it through email, or icq, about 255k long. hides itself in startup, and the reg.

you can name it anything you want, but must have the ( .exe ) at the end.

i'v played around with it before, pretty mean. can be very dangrous if the sender has your current ip address.

if your keyboard starts screwing up, and the
( caps ) are stuck on, email me, i can help......someone hacked me with it, so i know how to work with it......oh yeah i have the program now too!....lol

IP: Logged

phiend
Pro Bodybuilder
(Total posts: 316)
posted March 08, 2000 08:24 PM     Click Here to See the Profile for phiend     Edit/Delete Message UIN: 63040172
I just got an e-mail from a user on this board with an attachment of a steroid profile list, but it was accompanied by a virus, so I had to delete it.

IP: Logged

scourge1
Pro Bodybuilder
(Total posts: 105)
posted March 08, 2000 09:43 PM     Click Here to See the Profile for scourge1   Click Here to Email scourge1     Edit/Delete Message UIN: 2877127
Might have been the happy99 virus.
If you're e-mail account isn't using Outlook or Outlook Express with macros enabled you'll be safe.

It's a relatively harmless virus that uses Word macros embedded in Outlook to access your contact list and e-mail itself to everyone on it.

When have questions about virii or possible hoaxes just check out http://www.nai.com and look over their hoax and virii lists.

IP: Logged

Capt'n_Crunch
Amateur Bodybuilder
(Total posts: 18)
posted March 08, 2000 11:12 PM     Click Here to See the Profile for Capt'n_Crunch   Click Here to Email Capt'n_Crunch     Edit/Delete Message
Just to let you guys know, that virus that was on the gear profile list was not the Happy.exe worm. It was a W97Macro/class virus and is easily taken care of if you got norton or any other descent antivirus program. I recieved it today and inocculated it. If you dont know how to do it or jus too lazy email me and Ill send a clean copy in word format.

IP: Logged

BIGBADFKR
Amateur Bodybuilder
(Total posts: 36)
posted March 09, 2000 12:06 AM     Click Here to See the Profile for BIGBADFKR     Edit/Delete Message
I also encountered the Happy99.exe

IP: Logged

All times are ET (US)

Post New Topic  
Hop to:

�2016 EliteFitness.com. All rights reserved.

Powered by: Ultimate Bulletin Board (UltimateBB), Version 5.42a
� Infopop Corporation (formerly Madrona Park, Inc.), 1998-1999.