What Is The Win32 Virus?

The Win32 virus is an old, fairly harmless virus that modifies files so that it can automatically attach itself and an image of a fireworks display to your outgoing emails. It first showed up in 2005. It is displayed on incoming emails as an .exe file and is only activated if the file is opened. It does not do anything harmful to your computer or information. It can be removed manually or with a virus detecting tool.

Happy99.exe

This Win32 virus automatically attaches itself to newsgroup or e-mail messages. The attachment is titled HAPPY99.EXE. You must open the attachment (click on it) in order to activate the virus. It does not show up on outgoing emails, so the person who sent it does not usually know they sent a virus with their email.

What it does

Once you open the file, a display of fireworks appears on the screen as shown in the image above. Then, it creates two files in the system folder in your computer. They are named SKA.EXE and SKA.DLL. The first file is a copy of the virus. The second file will modify an existing file on your computer. The existing file is called WSOCK32.DLL. It will change that to WSOCK32.SKA. This will allow SKA.DLL to silently and invisibly attach the HAPPY99.EXE virus to all of your outgoing emails.

Considerations

Although the virus does not steal private information on your computer or crash or destroy any programs, it does have some downfalls. It could overload an email server if attached to too many emails at the same time. In addition, other, more dangerous viruses could attach themselves to it just because it gets passed around so much.

Removing the files

To remove the virus, click the Start Button, then choose Shut Down. Click on "Restart Computer in MS-DOS mode", then click on the button that says YES or OK. # Click Start, then Shut Down, then "Restart Computer in MS-DOS mode", then click Yes. Once the computer restarts, you will see a DOS prompt, which looks like a blinking cursor. Type the command, CD \WINDOWS\SYSTEM and hit Enter. Then, type
DEL SKA.EXE and hit enter, then type DEL SKA.DLL and hit enter again. This will delete the two virus files.

Repair the WSOCK32.DLL file

Return the WSOCK32.DLL to it's original condition by typing ATTRIB -RWSOCK32.DLL and hit enter, then type COPY WSOCK32.SKA WSOCK32.DLL and hit enter. If the computer asks you whether or not you really want to overwrite the file, click on "Yes". You are just replacing the modified file with the original. If you would like to download a free program that will do all this for you, check the link in the Resource section below.

References

• Article about the Win32 virus

Resources

• A tool you can download that will find and erase the Win32 virus (and others like it)