The HAPPY99.EXE file drops the W32/SKA 'worm' into your windows system directory. To remove it by hand, get to a DOS 'C:' prompt and CD to your windows system directory. (Because you can load Windows into any named directory, you may find WINDOWS, WINDOW, WIN95, W98 or some similarly named subdirecty. The SYSTEM directory is created by Windows and will be a constant) In the SYSTEM folder, you will find SKA.EXE. DELETE it. You will also find the infected WSOCK32.DLL and the original of that file WSOCK32.SKA. RENAME WSOCK32.SKA to WSOCK32.DLL. In order to do this, you need to DELETE the infected WSOCK32 first. (DON'T DELETE if the WSOCK32.SKA is not there!) This is sufficient to stop the worm from working. The worm also creates the registry entry -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ska.exe="Ska.exe and if you are comfortable using REGEDIT, you can delete this entry. If you don't, Windows will ignore it. The RMSKA.EXE available on the AVERT Team Stand-alone page will perform the above for you.