New Zealand computer users are warned to look out for a computer worm, called Happy99, that can send hundreds of copies to itself in the same newsgroups and email addresses that an affected user is posting or emailing to.
Auckland antivirus software company Applied Insight knows of two companies that have been hit by the worm and Computerworld is aware of two others that have been infected. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs. According to Finnish data security firm Data Fellows, users’ PCs don’t suffer ill effects by reading a Happy99 message in a Usenet newsgroup or in email. When someone executes the Happy99.exe attachment, a fireworks display appears on his or her screen.
Meanwhile, in the background, the worm alters the host computer’s Internet configuration to keep track of all email or newsgroup activity.
The worm then spams itself to the same newsgroups and email addresses to which a user posts. It also maintains a list of news-groups to which it has sent a copy of itself.
Data Fellows says the worm doesn’t pose a threat to computer files in the way a usual virus would but warns that it could slow or crash corporate email servers because of the volume of messages involved.
Original PC configurations can be restored by renaming the host computer’s winsock 32.dll file. In addition, Data Fellows has a patch available on its Web site at www.data fellows.com.