Frenquently Asked Questions

What if I have deleted WSOCK32.SKA before I restored WSOCK32.DLL?

Answer

I found WSOCK32.DLL. Do I delete it?

You need WSOCK32.DLL to access the internet. If you have the modified WSOCK32.DLL, you should replace it with the original. If it's not the modified WSOCK32.DLL, then you don't have to do anything with it. To check if you have the modified WSOCK32.DLL, check the next step.

How do I check if I am infected? How do I know I've replaced WSOCK32.DLL correctly?

Step 10 explains how to check. Here it is again:

If you aren't sure whether you are infected, choose Start, then Find, then "Files or Folders". Then type WSOCK32.DLL in the "Named" box. In the "Look in" box choose drive C: or whatever drive you have Windows on. In the "Containing Text" box type "ska.dll" without the quotes. Then click "Find Now".

If you don't find any files, that means that WSOCK32.DLL isn't the modified version. If you don't have the modified WSOCK32.DLL, the virus has no way to attach to e-mails, even if you have SKA.EXE, SKA.DLL, and WSOCK32.SKA in the Windows System folder. If you have SKA.EXE in the RunOnce registry section, and you haven't deleted SKA.EXE, then the virus will try to modify WSOCK32.DLL the next time you restart the computer. If you would like to check if SKA.EXE is in the registry, then do step 7. If you don't have the modified WSOCK32.DLL, and SKA.EXE isn't in the registry, the virus is completely inactive and is effectively removed.

I found SKA.HTM and SKA.GIF in Temporary Internet Items. Do I delete them?

Those aren't virus files. Those are a copy of my web page and the pictures in the web page. Don't delete them.

I found SKA.LGC. Do I delete it?

That isn't an infected virus file. Those are from the AppLog program which monitors which files a program accesses. There's no point in keeping it so you can delete it.

I found WSOCK32N.DLL. Do I delete it?

That file has nothing to do with the virus. It is a completely different file from WSOCK32.DLL. Don't delete it.

I found WSOCK32.SKA. Do I delete it?

WSOCK32.SKA is a copy of your original WSOCK32.DLL. Don't delete it until you've replace WSOCK32.DLL with WSOCK32.SKA. After that you can delete it.

What does it do besides spread and display fireworks?

Nothing. Everything it does it described in the main Win32/Ska page. If you use the modified WSOCK32.DLL you might get Invalid Page Faults or similar errors or maybe just a hang.

Does xxx Antivirus detect/remove this virus?

Most do if you use the latest update. You'll have to check with your antivirus manufacturer to be sure. I don't know of any antivirus(besides Happy99-specific cleaners) that renames WSOCK32.SKA to WSOCK32.DLL. You might want to follow the steps even if your antivirus says you're clean.

Can you show me what a typical DOS session looks like?

Sure. The items in BOLD are what the computer says. The items in italics are what you type. 
C:\WINDOWS>CD SYSTEM
C:\WINDOWS\SYSTEM>DEL SKA.EXE
C:\WINDOWS\SYSTEM>DEL SKA.DLL
C:\WINDOWS\SYSTEM>ATTRIB -R WSOCK32.DLL
C:\WINDOWS\SYSTEM>COPY WSOCK32.SKA WSOCK32.DLL
Overwrite WSOCK32.DLL (Yes/No/All)?y
        1 file(s) copied
C:\WINDOWS\SYSTEM>EXIT

My computer locks up when I try to restart in MS-DOS mode. What do I do?

There is probably an incompatible program in AUTOEXEC.BAT or DOSSTART.BAT. Finding which one is causing the problem is beyond the scope of this page. Until you figure it out, do this. The items in BOLD are what the computer says. The items in italics are what you type or do. 
Reboot the computer
Starting Windows 95...Press F8
Safe Mode Command Prompt Only
C:\>CD WINDOWS
C:\WINDOWS>CD SYSTEM
C:\WINDOWS\SYSTEM>DEL SKA.EXE
C:\WINDOWS\SYSTEM>DEL SKA.DLL
C:\WINDOWS\SYSTEM>ATTRIB -R WSOCK32.DLL
C:\WINDOWS\SYSTEM>COPY WSOCK32.SKA WSOCK32.DLL
Overwrite WSOCK32.DLL (Yes/No/All)?y
        1 file(s) copied
C:\WINDOWS\SYSTEM>EXIT
If you've read the FAQ and the main page and you still have a question, then click here if you want to E-Mail me a question or here if you just have a comment. Please read this page carefully before e-mailing me a question. I don't mind getting E-Mail, but I'm getting an unbelievable amount of e-mail on this topic. If you're having trouble with the removal, make sure you're following the steps exactly. Make sure you type the instructions exactly including spaces and punctuation. You might want to print out the removal instructions so you have something to refer to. If you're having trouble with the DOS commands, get a local person to help you with them. It's hard to know exactly how you're typing the DOS commands and what your exact situation is over E-Mail.

You may copy this information as long as you give credit to the source.

Main Win32/Ska Page
Virus Page