tasklist.org
tasklist.org - process list
   
tasklist.org
A comprehensive list of processes running in your computer  
tasklist | attachlist  
total tasks: 16297  
AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.
  search


  most requested






 
  Browse attachlist by file name:
|  a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |
Name: Happy99.Worm

Sender:


Subject:


Message:


Attachment:


Comments: A worm. When a computer is infected, it will open a window entitledHappy New Year 1999 !! and show a fireworks display.

Symptoms:


Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: If the removal tool doesn't work, follow these steps:
Most of the steps to manually remove this worm are performed in Safe mode. Follow the instructions in the order given in each section.
Enable show all filesFollow these steps to ensure that Windows is set to show all files:
Start Windows Explorer.
Click View, and then click Options or Folder options.
Click the View tab, and then uncheck "Hide file extensions for known file types."
Click Show all files, and then click OK.
Restart the computer in Safe mode
To remove the Happy99.Worm, the computer must be in Safe mode. Follow these steps to do this:
If you are using Windows 95:
Exit all programs, and then shut down the computer.
Turn off the computer, and wait 30 seconds. You must turn off the computer to remove the virus from memory. Do not use the reset button.
Turn on the computer. When you see the "Starting Windows 95" message, press F8.
Type the number that corresponds with Safe mode, and then press Enter.
If you are using Windows 98:
Click Start, and click Run.
Type msconfig and then Click OK. The System Configuration Utility dialog box appears.
Click Advanced on the General tab.
Check Enable Startup Menu, click OK, and then click OK again.
Exit all programs, and then shut down the computer.
Turn off the computer, and wait 30 seconds. You must turn off the computer to remove the virus from memory. Do not use the reset button.
Turn on the computer, and wait for the menu.
Type the number that corresponds with Safe mode, and then press Enter.
NOTES:Before continuing with these instructions, ensure that "Safe mode" appears in all four corners of the Windows desktop. Otherwise, you are not in Safe mode, and you cannot completely remove the worm.
If you are running Windows 98, when you are finished with the entire removal procedure, start the System Configuration Utility again and uncheck "Enable Startup Menu."
Find Wsock32.ska
Follow these steps to locate (if it still exists) the Wsock32.ska file (this is the backup, made by the worm, of the Wsock32.dll Windows file:
Click Start, point to Find, and click Files or Folders.
Make sure that Look in is set to (C:) and that Include subfolders is checked.
Type wsock32.ska in the Named box, and then click Find Now.
Leave it alone for now. (You will rename it later, in one of the sections that follows.)Click New Search to clear the current search, and then go on to the next section.
Find and delete the infected Wsock32.dll
Follow these steps to locate and delete the Wsock32.dll file that was placed on the hard drive by the worm:
Type wsock32.dll in the Named box, and then click Find Now.
Right-click the Wsock32.dll file in the results pane, click Delete, and then click Yes to confirm.
Click New Search to clear the current search, and then proceed to the next section.
Find and delete files
Follow these steps to locate and delete other files that were placed on the hard drive by the worm:
Type (or copy and paste) the following file names in the Named box, and then click Find Now:
ska.exe, ska.dll, happy99.exe, liste.ska
CAUTION: The next step is to delete these files from your system. Make sure that you delete only the files listed and, if you typed the file names, that they were typed exactly as shown. Deleting the wrong file could cause your system to fail to start.
Right-click each file in the results pane, click Delete, and then click Yes to confirm.
Click New Search to clear the current search, and then proceed to the next section.
Find and rename the Wsock.ska file
Follow these steps to restore the original Wsock32.dll file:
Type wsock32.ska in the Named box, and then click Find Now.
Right-click the Wsock32.ska file in the results pane, and click Rename.
Type wsock32.dll and then press Enter.
Close the Find Files window.
Empty the Recycle Bin
To make sure that the files are removed from the computer, right-click the Recycle Bin icon on the Windows desktop, and click Empty Recycle Bin.
Remove the registry entries left by Happy99.Worm
This will not be necessary in all cases. If you have not seen messages that refer to a "missing ska.exe" file, then you can skip this section for now. If you see such a message after you restart the computer, then return to this section and follow the instructions. In that case, it is not necessary to restart in Safe mode.
If you have seen the "missing ska.exe" message, then follow these steps:
CAUTION: We strongly recommend that you back up the system registry before making any changes to it. Incorrect changes to the registry may result in permanent data loss or corrupted files. Please make sure that you modify only the keys specified. Please see the document How to back up the Windows registry before proceeding.
Click Start, and click Run.
Type regedit and then press Enter.
Navigate to the following subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
In the right pane, select the following value, press Delete, and then click Yes to confirm:
SKA.EXE
Exit the Registry Editor.
Restart the computer
This concludes the removal procedure. Restart the computer, and then verify that you can use your Web browser.
© Copyright 2004, TaskList.org. All rights reserved. Portions copyright by Paul Collins (Pacs Portal). Disclaimer. Links