Trojan, worm or virus, it's a pain; Happy99: This file transmitted by e-mail or on newsgroups can infect your PC without your knowing it.

Ack! I've been attacked by a killer Trojan worm!

Yes, you read that right. We consumers would call it a virus. But experts in Computing Land say the correct term is either "Trojan" or "worm." (I added the "killer" part for fun!)


It all started with an innocent session at the computer. I sat down, signed online and checked my e-mail.

I get a lot of e-mail, and many times the messages come with attachments, such as electronic greeting cards or press releases sent as Word documents.


So I wasn't surprised to see an e-mail waiting for me that carried an attached file. This one was a small executable program called "happy99.exe."

I detached the file and, just to be safe, scanned it with my anti-virus software. "No viruses detected," came the message a couple seconds later.

So, being the trusting individual that I am, I went ahead and double-clicked happy99.exe. A window opened and I was treated to a rather nice display of fireworks shooting skyward and exploding.

OK, enough of that, I thought. I closed the window and deleted happy99.exe.

Or so I thought.

I didn't give it another thought until I again checked my e-mail. There was an automated message from a City of Phoenix computer informing me that a message I'd sent to a city employee had been killed before it was delivered because it contained a virus.

I didn't know what to make of such an e-mail. But to see what was happening, I sent myself a test e-mail. Soon it arrived in my e-mail box. Guess what was attached? You got it. A copy of happy99.exe.

That's when I hit the Internet, and conducted a search using the term "happy99.exe."


As I quickly learned, this isn't just a fireworks display. This "Trojan" or "worm" program digs into computer systems, renames itself and changes settings. Then, each time the infected system is used to send e-mail or post newsgroup messages, the Trojan/worm attaches a copy of happy99.exe to the outgoing message.

And all this takes place without the user of the infected system ever knowing. Both Symantec, the maker of Norton Anti Virus software, and Data Fellows call happy99.exe a "worm." Others argue that it's a "Trojan." All seem to agree it's not a "virus."

Generally speaking, a virus is a program that can replicate itself, can cause damage to computer systems and networks and can attach itself to other programs. A Trojan is a type of virus that masquerades as a benign application, but doesn't replicate itself. A worm is a type of virus that can replicate itself but cannot attach itself to other programs.

Whatever you call it, happy99.exe is a pain, and it's just a few weeks old, which would explain why my anti-virus software failed to detect it. To keep up with all the new viruses, anti-virus software must be updated, something I hadn't done since October.

Luckily, several Web sites include instructions for manually removing happy99.exe from infected systems. The one I used is at

I followed the instructions and removed happy99.exe from my system. Then I purchased and downloaded a new anti-virus program, which I immediately updated. When it ran, it discovered and deleted a piece of happy99.exe that I had missed.


By now, you may be wondering if your system is infected. If so, send yourself an e-mail to see if anything comes attached. You also can conduct a file search of your hard drive. If you find happy99.exe, ska.exe, ska.dll or wsock32.ska, you got it, baby!

And, if anybody sends you e-mail with happy99.exe as an attachment, just delete it. The havoc occurs only if you execute the file by double-clicking it.

Pub Date: 03/22/99