Name:         SOCKLOCK.ZIP
File:         SOCKLOCK.ZIP
Type:         SockLock - Protects winsock from Happy99/SKA
EMail:        Kevin McAleavey <kevinmca@nsclean.com>
Index Blurb:  SockLock - Protects winsock from Happy99/SKA

SOCKLOCK.ZIP - Utility that locks the MS Winsock to prevent the Happy99
               and similar trojans which modify the winsock from being
               able to access it or modify it. Also creates two small
               (72 bytes each) files to fool the trojan into thinking
               it has already been installed if placed on your machine.
               This utility was created as a result of a large number
               of reports of damaged systems caused by this trojan
               horse program and will prevent your system from being
               attacked by it. Happy99 and similar trojans are very
               widespread at the time of this program's release. More
               information on this program can be found at:

               http://www.nsclean.com/socklock.html

               This program works with Windows95, Windows98 and NT, all
               versions and/or "service pack" levels. This program is
               intended to be used BEFORE an attack as a preventative
               measure.

INSTALLATION
------------
1. Create a new directory.

2. Copy the file SOCKLOCK.ZIP to the new directory.

3. Unzip the SOCKLOCK.ZIP file with the unzip utility of your choice.

4. Optionally delete the zip file.

5. RUN the SockLock.Exe file in your new directory. Instructions on screen.

 Please note that SockLock.Exe is NOT "installed" into your system. There is
no "setup" program and the only copy of the files are right where you decide
to place them when you unzip this archive.

 The program presents two buttons, one marked "Protect Winsock with SockLock"
and a second button to remove the protection. When you press the button to
apply protection, SockLock will change the file attributes of the files
WSOCK32.DLL and WINSOCK.OCX in your \windows\system folder to hidden, read-
only and system markings and will also apply a share-lock to these files.

 The change in attributes and application of the share-lock will not affect
the operation of winsock in any way other than preventing it from being
overwritten by trojan horses that implant themselves into the winsock by
overwriting and/or modifying the winsock. This in turn prevents the trojan
from being able to install itself.

 SockLock also creates two additional files of 72 bytes each named SKA.EXE
and SKA.DLL which are actually plain text files with executable file names.
SockLock will also lock these two new files which are placed on your machine
to fool the trojans into believing they've already been installed.

 Clicking on the "Remove SockLock protection" button will remove the file
locks as well as the two additional files created by SockLock and restore
all settings to their previous state. If SockLock protection is removed,
Happy99 and other SKA class trojans will be able to be installed on your
machine. The remove button is provided as a quick means of removing the
protective actions of SockLock if desired to assuage any concerns.


TO UNINSTALL:
-------------
1. Remove the files in the directory you created

2. Remove the directory you created.

5. Everything is now deleted safely.


Freeware. Uploaded by the author. All support questions
should be directed to the author at the address below:

Kevin McAleavey
Privacy Software Corporation
support@nsclean.com
http://www.nsclean.com
http://www.privsoft.com

Distribution unlimited with one provision - modification in any way of the
SockLock program is prohibited. Distribute unmodified copies freely.
