ARCHIVED: What is the Happy99 virus, and how do I remove it?

The Happy99 virus or worm infects your computer when you open an email attachment with the name Happy99.exe. (The terms "virus" and "worm" are used somewhat interchangeably, though Happy99 is more accurately termed a worm, since it is an independent entity rather than code hidden inside another file.)

If you receive an attachment named Happy99.exe, do not run it. Instead, delete the attachment immediately, without opening the file or saving it.

The following error messages can be symptoms of Happy99 infection:

MSIMN caused an invalid page fault in module Kernel32.dll
MSIMN caused an invalid page fault in module unknown
Explorer caused an invalid page fault in module Mailnews.dll at 014f:62060a0f
Outlook caused an Invalid Page Fault in module Unknown
MSIMN caused an invalid page fault in module Inetcomm.dll

If you are using Windows NT, 2000, or XP, the Happy99 worm cannot infect your computer. However, if you are using Windows 95, 98, or Me and you accidentally ran the Happy99.exe attachment, use the following procedures to remove it.

The Fixhappy.exe removal tool

Symantec offers a tool named Fixhappy.exe to help you remove this worm. This is generally the preferred course of action. The tool and instructions for using it are available from:

  http://www.sarc.com/avcenter/venc/data/fix.happy99.worm.html

Manual removal of the Happy99 worm

If you cannot remove the worm by using the removal tool, then you must manually remove the worm. How you do this depends on whether you still have a copy of the original Wsock32.dll file (the file that is used by the worm) on your computer. You can find both sets of instructions at:

  http://securityresponse.symantec.com/avcenter/venc/data/happy99.worm.html

For more background information on the Happy99 worm, visit the following sites:

  http://zdnet.com.com/2100-11-513524.html

  http://www.geocities.com/SiliconValley/Heights/3652/SKA.HTM