Happy99.exe is a DOS virus

[Joseph Ramstrom]

I gotten this one before.  it infects winsock.  If you have run it you will 
have a new winsock.dll and a winsok.old; also a class.sys in the c:\ dir.  
This is a nice one as far as virii are concerned.  Boot to dos only.  Throw 
winsock.dll away and rename winsock.old to winsock.dll and don't forget to 
'attrib +s' it.  also delete class.sys as this will reinfect a repaired 
winsock.  There is also much documentation at symantic, mcafee, etc sites.  
p.s. 'class' is a name of a group of hackers, they have lots of different 
things floating around.




b.layer%vikingelectronics.com at Internet
05/24/99 02:59 PM
To:	synth-diy%mailhost.bpa.nl at Internet
cc:	 (bcc: Joseph Ramstrom)
Subject:	Happy99.exe is a DOS virus

Hi,

I'm not sure what is up, but I just got an attachment from a list member that 
is a live virus.. Do NOT execute happy99.exe it is a DOS worm.




Bill Layer
Sales Technician
<b.layer at vikingelectronics.com>

+----------------------------------+
     Viking Electronics, Inc.
       1531 Industrial St.
    Hudson, WI. 54016 - U.S.A
      715.386.8861 ext. 210
 <http://www.vikingelectronics.com>
+----------------------------------+

"Telecom Solutions for the 21st Century"