OLEXP: Error Message: "Invalid Page Fault in Kernel32.dll" with Happy99.exe Virus

Article ID: 221486 - View products that this article applies to.
This article was previously published under Q221486
For information about the differences between Microsoft Outlook Express and Microsoft Outlook e-mail clients, click the following article number to view the article in the Microsoft Knowledge Base:
257824
(http://support.microsoft.com/kb/257824/EN-US/ )
OL2000: Differences Between Outlook and Outlook Express
Expand all | Collapse all

SYMPTOMS

When you attempt to send an e-mail message with an attachment, you may receive one of the following error messages:
  • MSIMN caused an invalid page fault in module Kernel32.dll
    MSIMN caused an invalid page fault in module unknown
    Explorer caused an invalid page fault in module Mailnews.dll at 014f:62060a0f
    Outlook caused an Invalid Page Fault in module Unknown
    MSIMN caused an invalid page fault in module Inetcomm.dll
When you attempt to post to a newsgroup, the post may not succeed, and you may receive the following response from the server:
500 What?
When you start Outlook 98, you may receive the following error message:
MAPI32 caused an invalid page fault in module Kernel32.dll
When you try to perform various operations, you may receive the following message:
This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
When you try to start your computer, you may be unable to do so.
Back to the top | Give Feedback

CAUSE

This behavior can occur if you have run the Happy99.exe virus program on your computer. When you do so, your computer becomes infected with this virus program.
Back to the top | Give Feedback

RESOLUTION

To resolve this issue:
  1. Restart your computer. Press and hold down the CTRL key until you see the Windows 98 Startup menu (for Windows 95, press F8 when you see "Starting Windows 95"), and then choose Safe Mode Command Prompt Only.
  2. Type the following commands, pressing ENTER after each command:
    cd windows\system
    copy liste.ska c:\windows\desktop\liste.txt
    del ska.dll
    del ska.exe
    ren wsock32.dll wsock32.old
    copy wsock32.ska wsock32.dll
  3. Restart your computer normally.
NOTE: If Happy99.exe is run more than once on a computer, the Wsock32.ska file also carries the virus payload. In these instances, you must extract a "clean" copy of the Wsock32.dll file again.
Back to the top | Give Feedback

MORE INFORMATION

Happy99.exe is a 32-bit Windows-based Trojan Horse virus. When you run this program, it displays fireworks on the screen. It also creates two files named Ska.exe and Ska.dll, copies your original Wsock32.dll file to Wsock32.ska, and modifies the Wsock32.dll file.

The Wsock32.dll file cannot be modified if it is in use. If the Wsock32.dll file is in use when you run the Happy99.exe program, it adds an entry to the registry that runs Ska.exe the next time the computer is started, and then modifies the Wsock32.dll file. The modified Wsock32.dll file detects when e-mail messages and newsgroup postings are sent, and sends a copy of the Ska.exe file, named Happy99.exe, in those messages. All e-mail addresses that are sent a copy of the file are recorded in the Liste.ska file in the Windows\System folder. The Liste.ska file is a text file, and you can view it by using any text editor (such as Notepad).

For additional information about computer viruses, please see the following article in the Microsoft Knowledge Base:
129972
(http://support.microsoft.com/kb/129972/EN-US/ )
Description of Computer Viruses
NOTE: This virus is created and modified by individuals not associated with Microsoft, and the preceding troubleshooting steps may not alleviate behaviors caused by variant strains of this virus. Customers should contact their antivirus software manufacturer for a more comprehensive solution.
Back to the top | Give Feedback

Properties

Article ID: 221486 - Last Review: June 24, 2004 - Revision: 2.0
APPLIES TO
  • Microsoft Outlook Express 5.0
  • Microsoft Outlook Express 4.01 Service Pack 1
  • Microsoft Outlook Express 4.01 Service Pack 2
  • Microsoft Outlook Express 4.0
  • Microsoft Outlook Express 5.5
  • Microsoft Outlook Express 4.01 Service Pack 1
  • Microsoft Outlook Express 4.01 Service Pack 2
  • Microsoft Outlook Express 5.0
  • Microsoft Outlook Express 4.01 Service Pack 1
  • Microsoft Outlook Express 4.01 Service Pack 2
  • Microsoft Outlook Express 4.0
  • Microsoft Internet Mail and News 1.0
  • Microsoft Outlook 98 Standard Edition
  • Microsoft Windows NT Server 4.0 Standard Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
Keywords: 
kberrmsg kbprb KB221486
Back to the top | Give Feedback

Give Feedback

 
Back to the topBack to the top