[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: regarding happy99 virus



Hi guys/grrls!

When the Happy.EXE is run it copies itself to Windows\System
folder under the name SKA.EXE. It then extracts, from within
itself, a DLL called SKA.DLL into the Windows\System folder
if one does not already exist.

You can check your Windows\System folder to see if you have this file.

The worm then creates the registry entry -
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ska.exe="Ska.exe"

You can also check this directory for this file. Use [Start]->[Run]->regedit.exe

See you.

Eric


_______________________________________________________________ Get Free Email and Do More On The Web. Visit http://www.msn.com