KYBATH-L Archives

From: David <>
Subject: [KYBATH-L] possible virus
Date: Sat, 24 Jul 1999 23:15:02 -0500

To everyone,

In case I sent you any email since March 1999, I may have sent you the
Happy99.exe attachment. I am very sorry. Here the information on the
files it attaches to.

If you have a virus scanner and it has been updated within the last
month or two the virus is called w32/ska.

When run it puts a couple of files in the directory C:\windows\system.
They are "ska.exe", "ska.dll", and "wsock32.dll"--this file is required
for the internet to work. The virus backs up this file as
"wsock32.ska"--this is the clean file. You need to delete the
wsock32.dll file and rename the .ska file to wsock32.dll. Also delete
ska.exe and ska.dll and the Happy99.exe.

Sorry for the inconvenience. My suggestion is to make sure that you
have a really good virus scanner or you are probably infected also.

Becky and David Rubke

This thread:

• [KYBATH-L] possible virus by David <>