[CH] An email worm
Brandon C Nuttall (bnuttall@kih.net)
Sat, 07 Aug 1999 06:06:04 -0400
Folks,
Since I'm in digest mode, this is probably a duplicate of many such emails,
but it is important. The Happy99 email worm was distributed as an
attachment to an email to the list. DON'T RUN THE PROGRAM. It modifies your
system to send itself with every email whenever and internet connection is
detected. See http://www.symantec.com/avcenter/venc/data/happy99.worm.html
for more information.
If your virus detection software found it and wiped it out, YEAH!
If your virus detection software missed it: a) update your virus definition
file, or b) get a new virus protection package, and c) you must clean up
your system.
If you executed the program, you need to clean up your system to remove the
worm.
Bye the way, Happy99 is a stealth type worm. The person that distributed
the attachment most likely has no idea they are infected. While the program
is innocently displaying fireworks on your screen behind the scenes, it is
altering your WINSOCK and other dll's. Then, when an email is sent, it
attaches itself to the message, you never knew what hit you. Fortunately,
Happy99 is not diabolically destructive. Some worms trash your system.
Hope everything is all right. Happy virus hunting.
Brandon C. Nuttall
bnuttall@kih.net