Microsoft KB Archive/221486

= OLEXP: Error Message: "Invalid Page Fault in Kernel32.dll" with Happy99.exe Virus =

Article ID: 221486

Article Last Modified on 6/24/2004

-

APPLIES TO


 * Microsoft Outlook Express 5.0
 * Microsoft Outlook Express 4.01 Service Pack 1
 * Microsoft Outlook Express 4.01 Service Pack 2
 * Microsoft Outlook Express 4.0
 * Microsoft Outlook Express 5.5
 * Microsoft Outlook Express 4.01 Service Pack 1
 * Microsoft Outlook Express 4.01 Service Pack 2
 * Microsoft Outlook Express 5.0
 * Microsoft Outlook Express 4.01 Service Pack 1
 * Microsoft Outlook Express 4.01 Service Pack 2
 * Microsoft Outlook Express 4.0
 * Microsoft Internet Mail and News 1.0
 * Microsoft Outlook 98 Standard Edition
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition

-



This article was previously published under Q221486



For information about the differences between Microsoft Outlook Express and Microsoft Outlook e-mail clients, click the following article number to view the article in the Microsoft Knowledge Base:

257824 OL2000: Differences Between Outlook and Outlook Express



SYMPTOMS
When you attempt to send an e-mail message with an attachment, you may receive one of the following error messages:  

MSIMN caused an invalid page fault in module Kernel32.dll

MSIMN caused an invalid page fault in module unknown

Explorer caused an invalid page fault in module Mailnews.dll at 014f:62060a0f

Outlook caused an Invalid Page Fault in module Unknown

MSIMN caused an invalid page fault in module Inetcomm.dll



When you attempt to post to a newsgroup, the post may not succeed, and you may receive the following response from the server:

500 What?

When you start Outlook 98, you may receive the following error message:

MAPI32 caused an invalid page fault in module Kernel32.dll

When you try to perform various operations, you may receive the following message:

This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

When you try to start your computer, you may be unable to do so.



CAUSE
This behavior can occur if you have run the Happy99.exe virus program on your computer. When you do so, your computer becomes infected with this virus program.



RESOLUTION
To resolve this issue:  Restart your computer. Press and hold down the CTRL key until you see the Windows 98 Startup menu (for Windows 95, press F8 when you see "Starting Windows 95"), and then choose Safe Mode Command Prompt Only. Type the following commands, pressing ENTER after each command:

cd windows\system

copy liste.ska c:\windows\desktop\liste.txt

del ska.dll

del ska.exe

ren wsock32.dll wsock32.old

copy wsock32.ska wsock32.dll

 Restart your computer normally.</ol>

NOTE: If Happy99.exe is run more than once on a computer, the Wsock32.ska file also carries the virus payload. In these instances, you must extract a "clean" copy of the Wsock32.dll file again.

<div class="moreinformation_section">

MORE INFORMATION
Happy99.exe is a 32-bit Windows-based Trojan Horse virus. When you run this program, it displays fireworks on the screen. It also creates two files named Ska.exe and Ska.dll, copies your original Wsock32.dll file to Wsock32.ska, and modifies the Wsock32.dll file.

The Wsock32.dll file cannot be modified if it is in use. If the Wsock32.dll file is in use when you run the Happy99.exe program, it adds an entry to the registry that runs Ska.exe the next time the computer is started, and then modifies the Wsock32.dll file. The modified Wsock32.dll file detects when e-mail messages and newsgroup postings are sent, and sends a copy of the Ska.exe file, named Happy99.exe, in those messages. All e-mail addresses that are sent a copy of the file are recorded in the Liste.ska file in the Windows\System folder. The Liste.ska file is a text file, and you can view it by using any text editor (such as Notepad).

For additional information about computer viruses, please see the following article in the Microsoft Knowledge Base:

129972 Description of Computer Viruses

NOTE: This virus is created and modified by individuals not associated with Microsoft, and the preceding troubleshooting steps may not alleviate behaviors caused by variant strains of this virus. Customers should contact their antivirus software manufacturer for a more comprehensive solution.

Additional query words: oe4top worm trojan horse ipf happy99 KERNEL32 dll mailnews inetcomm ska exe wsock32 antivirus w98hem

Keywords: kberrmsg kbprb KB221486

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.