The HAPPY99.EXE file drops the W32/SKA 'worm' into your
windows system directory.  To remove it by hand, get to a
DOS 'C:' prompt and CD to your windows system directory.

(Because you can load Windows into any named directory,  you
 may find WINDOWS, WINDOW, WIN95, W98 or some similarly named
 subdirecty.  The SYSTEM directory is created by Windows and
 will be a constant)

In the SYSTEM folder, you will find SKA.EXE.   DELETE it.

You will also find the infected WSOCK32.DLL  and the original
of that file WSOCK32.SKA.  RENAME WSOCK32.SKA to WSOCK32.DLL.
In order to do this, you need to DELETE the infected WSOCK32 first.
(DON'T DELETE if the WSOCK32.SKA is not there!)

This is sufficient to stop the worm from working.

The worm also creates the registry entry
 -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ska.exe="Ska.exe

and if you are comfortable using REGEDIT, you can delete this entry.
If you don't, Windows will ignore it.

The RMSKA.EXE available on the AVERT Team Stand-alone page will
perform the above for you.
