OLEXP: Error Message: "Invalid Page Fault in Kernel32.dll" with Happy99.exe Virus (221486)


The information in this article applies to:

  • Microsoft Outlook Express 5.0 for Windows NT 4.0
  • Microsoft Outlook Express 4.01 for Windows NT 4.0 SP 1
  • Microsoft Outlook Express 4.01 for Windows NT 4.0 SP 2
  • Microsoft Outlook Express 4.0 for Windows NT 4.0
  • Microsoft Outlook Express 5.5 for Windows Millennium Edition
  • Microsoft Outlook Express 4.01 for Windows 98 SP 1
  • Microsoft Outlook Express 4.01 for Windows 98 SP 2
  • Microsoft Outlook Express 5.0 for Windows 95
  • Microsoft Outlook Express 4.01 for Windows 95 SP 1
  • Microsoft Outlook Express 4.01 for Windows 95 SP 2
  • Microsoft Outlook Express 4.0 for Windows 95
  • Microsoft Internet Mail and News 1.0 for Windows 95
  • Microsoft Outlook 98
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Workstation 4.0
This article was previously published under Q221486
For information about the differences between Microsoft Outlook Express and Microsoft Outlook e-mail clients, click the following article number to view the article in the Microsoft Knowledge Base:

257824 OL2000: Differences Between Outlook and Outlook Express

SYMPTOMS

When you attempt to send an e-mail message with an attachment, you may receive one of the following error messages:
  • MSIMN caused an invalid page fault in module Kernel32.dll
    MSIMN caused an invalid page fault in module unknown
    Explorer caused an invalid page fault in module Mailnews.dll at 014f:62060a0f
    Outlook caused an Invalid Page Fault in module Unknown
    MSIMN caused an invalid page fault in module Inetcomm.dll
When you attempt to post to a newsgroup, the post may not succeed, and you may receive the following response from the server:
500 What?
When you start Outlook 98, you may receive the following error message:
MAPI32 caused an invalid page fault in module Kernel32.dll
When you try to perform various operations, you may receive the following message:
This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
When you try to start your computer, you may be unable to do so.

CAUSE

This behavior can occur if you have run the Happy99.exe virus program on your computer. When you do so, your computer becomes infected with this virus program.

RESOLUTION

To resolve this issue:
  1. Restart your computer. Press and hold down the CTRL key until you see the Windows 98 Startup menu (for Windows 95, press F8 when you see "Starting Windows 95"), and then choose Safe Mode Command Prompt Only.
  2. Type the following commands, pressing ENTER after each command:

    cd windows\system
    copy liste.ska c:\windows\desktop\liste.txt
    del ska.dll
    del ska.exe
    ren wsock32.dll wsock32.old
    copy wsock32.ska wsock32.dll

  3. Restart your computer normally.
NOTE: If Happy99.exe is run more than once on a computer, the Wsock32.ska file also carries the virus payload. In these instances, you must extract a "clean" copy of the Wsock32.dll file again.

MORE INFORMATION

Happy99.exe is a 32-bit Windows-based Trojan Horse virus. When you run this program, it displays fireworks on the screen. It also creates two files named Ska.exe and Ska.dll, copies your original Wsock32.dll file to Wsock32.ska, and modifies the Wsock32.dll file.

The Wsock32.dll file cannot be modified if it is in use. If the Wsock32.dll file is in use when you run the Happy99.exe program, it adds an entry to the registry that runs Ska.exe the next time the computer is started, and then modifies the Wsock32.dll file. The modified Wsock32.dll file detects when e-mail messages and newsgroup postings are sent, and sends a copy of the Ska.exe file, named Happy99.exe, in those messages. All e-mail addresses that are sent a copy of the file are recorded in the Liste.ska file in the Windows\System folder. The Liste.ska file is a text file, and you can view it by using any text editor (such as Notepad).

For additional information about computer viruses, please see the following article in the Microsoft Knowledge Base:

129972 Description of Computer Viruses

NOTE: This virus is created and modified by individuals not associated with Microsoft, and the preceding troubleshooting steps may not alleviate behaviors caused by variant strains of this virus. Customers should contact their antivirus software manufacturer for a more comprehensive solution.
Modification Type:MajorLast Reviewed:6/24/2004
Keywords:kberrmsg kbprb KB221486
©2004 Microsoft Corporation. All rights reserved.