Happy99 FAQ.

Protector Plus Antivirus Software will take care of Happy99 trojan without any problem. Detailed information about this trojan is available at the Happy99 trojan information page. This FAQ page will help you if you have any questions or facing any problems while removing Happy99.

This FAQ contains:

1. What does Happy99 trojan do?

2. My mail recipients are complaining that I am sending Happy99.EXE as an attachment. How can I solve this problem?

3. I have received Happy99.EXE as an email attachment. What is this file?

4. I have deleted SKA.EXE and SKA.DLL. I am getting "Access Denied" error while renaming WSOCK32.SKA to WSOCK32.DLL. What is the solution?

5. When I scan my computer the scanner is not detecting Happy99. But my email recipients are complaining that I am sending two messages to them. What is wrong?

6. I have deleted SKA.EXE only. What happens now when I send a mail?

7. I have deleted SKA.EXE and SKA.DLL, but I have not renamed WSOCK32.SKA to WSOCK32.DLL, is the trojan active now? What happens now when I send an email?

8. I have WSOCK32N.DLL file in the WINDOW\SYSTEM directory. What is this file?

9. Does Happy99 affect WebTV, MAC, Linux?

 1. What does Happy99 trojan do ?

Refer Happy99 trojan information page.

 2. My mail recipients are complaining that I am sending Happy99.EXE as an                                                    attachment. How can I solve this problem? 

You are infected with Happy99 trojan. More information on Happy99 removal is available at:                      http://www.protectorplus.com/trojan_info/win32/happy99.htm

Follow the manual removal procedure explained in that page, if you are confident of doing it. Otherwise download Protector Plus and scan your computer to get rid of Happy99.

 3. I have received Happy99.EXE as an email attachment. What is this file?

The file contains a trojan called Happy99. If you have not executed that file you should delete the file. You may also inform the sender that his computer is infected with Happy99. If you are not sure where this file is located and if you are not able to delete it you can download Protector Plus and scan your computer to get rid of Happy99.

If you have executed the file you might have seen the fire works displayed. While the file works was displayed the trojan in the program would have installed itself in your computer. If this is the case the trojan will be sending itself as an attachment to all the emails you are sending.

Refer to the question 2 above for details of removing this trojan.

  4. I have deleted SKA.EXE and SKA.DLL. I am getting "Access Denied" error while renaming WSOCK32.SKA to WSOCK32.DLL. What is the solution?

Protector Plus would have taken care of renaming if it detects SKA.EXE. As that file is deleted by you when you scan the computer Protector Plus will not detect Happy99. You will have to rename the file manually. However if windows is using WSOCK32.DLL it does not allow you to rename this file. You will get the Acess Denied error. In such a case to rename WSOCK32.SKA to WSOCK32.DLL follow this procedure.

Boot the system with MSDOS option under Windows 95/98 by selecting "Shut Down" option from the "Start" button of Windows 95/98. Select "Restart the computer in MSDOS mode" and click "Yes" to boot the system with MSDOS mode.

You will see the DOS prompt which will be something like:

C:\> or C:\WINDOWS>

At the prompt type the 3 commands mentioned below exactly as they are. Press Enter key after you type in each command.

CD    \WINDOWS\SYSTEM

REN   WSOCK32.DLL   WSOCK32.OLD

REN   WSOCK32.SKA   WSOCK32.DLL

If you have entered the above commands properly, you will not get any error or any other message. If you get any error or some other message please contact us at  support@protectorplus.com with the excact description of the error you have encountered.

Now restart your computer and you should be free of all traces of Happy99.

User can delete WSCOK32.OLD after renaming the WSOCK32.SKA successfully.

 5. When I scan my computer the scanner is not detecting Happy99. But my email recipients are complaining that I am sending two messages to them. What is wrong?

You would have deleted only SKA.EXE file. As SKA.DLL file is present and WSOCK32.DLL is modified by Happy99, it will be sending the second mail to your email recipients. Refer to question 4 for the procedure to remove Happy99 completely.

  6. I have deleted SKA.EXE only. What happens now when I send a mail?

Deleting SKA.EXE will not effectively remove the trojan from your computer. SKA.DLL file will be sending the second mail to all the users but without the Happy99 attachment. So you may get complain from your email recepients. As SKA.EXE is deleted by you when you scan the computer Protector Plus will not detect Happy99. You will have to delete and rename the files manually. To remove Happy99 completely delete SKA.DLL and refer to the question 4 for the procedure to rename files.

 7. I have deleted SKA.EXE and SKA.DLL, but I have not renamed WSOCK32.SKA to WSOCK32.DLL, is the trojan active now? What happens now when I send an email?

Deleting SKA.EXE and SKA.DLL will effectively remove the trojan from your computer. No mail attachments will be sent even if WSOCK32.SKA is not renamed as WSOCK32.DLL. However WSOCK32.DLL will have some reference to SKA.DLL. So it is better to rename WSOCK32.SKA to WSOCK32.DLL. As SKA.EXE is deleted by you when you scan the computer Protector Plus will not detect Happy99. You will have to rename the file manually.

Refer to the question 4 for the procedure to rename files.

 8. I have WSOCK32N.DLL file in the WINDOW\SYSTEM directory. What is this file?

This file has got nothing to do with Happy99.

Refer to other questions in this FAQ to make sure that you dont have any traces of Happy99.

 9. Does Happy99 affect WebTV, MAC, Linux?

No. Happy99 affects only Windows 95/98 and Windows NT.