Happy99 Sent Fireworks By Email

Picture a New Year’s Eve party at the very end of 1998. The room is warm, the music is loud, and everyone is watching the sky burst into colour. Nobody is watching the quiet guest near the door. While every face is turned upward, smiling at the fireworks, that guest moves softly from coat to coat in the hallway, slipping a small folded paper into every pocket. By the time the guests go home, each of them is carrying something they never agreed to take — and tomorrow, without knowing it, they will pass it on to everyone they meet.

That is almost exactly what happened on the early internet in January 1999, except the party was an inbox, the fireworks were on a computer screen, and the quiet guest was a small program called Happy99. It arrived smiling. It asked for nothing. And it spread around the world on the back of one of the happiest nights of the year.

What the Happy99 worm actually did behind the fireworks

Happy99, also known as Ska, was one of the first email worms to travel successfully around the world. A worm is a special kind of harmful program: unlike a virus that hides inside another program and waits, a worm’s whole purpose is to copy itself and move from machine to machine. According to accounts of the worm, it was written by a virus creator who used the nickname “Spanska.”

The worm arrived as an email with an attachment named Happy99.exe. That “.exe” ending matters — it meant the attachment was not a picture, not a card, and not a letter. It was a program, a file that could run and do things. But almost nobody in 1999 thought about file endings. Email was still new and exciting for most families, and an attachment named “Happy99” sounded like a gift.

Anyone who ran the file got a lovely little show. Fireworks sparkled across the screen, together with the greeting words “Happy New Year 1999!!” It looked like a cheerful greeting card sent by a kind friend. There was no warning, no strange error, nothing frightening at all.

The real action happened quietly, underneath the celebration. While the fireworks played, Happy99 installed itself into the part of the computer that handled sending email — the machinery behind the scenes that delivers messages. From that moment, the computer belonged to the worm in one small but powerful way. Whenever its owner sent an email, or posted a message to an online discussion group, Happy99 secretly sent a second, separate message right behind it, carrying a fresh copy of itself as an attachment.

The owner never saw this happen. There was no copy in the sent folder to raise questions, no flicker on the screen. You wrote to your cousin about Sunday lunch; your cousin received your message — and then a second, empty message arrived with nothing in it but the Happy99.exe file attached. The worm had used your good name as its invitation.

To me, the creepiest part is that the victim did nothing selfish or careless after that first click: they simply wrote ordinary emails to people they loved, and every single one became a delivery.

How Happy99 spread from friend to friend

Happy99 did not need clever hacking to travel. It needed trust, and the early internet had plenty of it. Email between friends felt private and safe, like a sealed letter. If a message came from your brother’s address, you assumed your brother had sent every part of it.

The worm’s design fed on that assumption in a very sneaky way. The dangerous second message always followed a genuine one. So a typical infection looked like this: you received a normal, friendly email from someone you knew. Moments later, a strange follow-up arrived from the same person, completely empty except for an attachment called Happy99.exe. Many people reasoned that their friend had simply forgotten to attach the file the first time, and had sent it along right after. They opened it to be polite — and the fireworks went off again, in a new home, on a new machine.

From there, the cycle repeated perfectly. The newly infected computer waited for its owner to write to anyone at all, then tucked a copy of the worm behind the message. Every address that person ever emailed became a possible new victim. Discussion groups widened the circle even further, because one infected post could be read by hundreds of strangers.

The second email was its only tell

Happy99 had one weakness: it could not write words. Its follow-up messages were empty. No subject line full of promises, no message explaining the attachment — just silence and a file. That emptiness was the fingerprint. People who noticed a bare, wordless email trailing behind a real one had spotted the worm’s only visible trace. But in 1999, email was strange enough already that most people shrugged and clicked anyway.

This is also what makes Happy99 such a useful story today. Modern trick emails are far better written, dressed up with logos, names and urgent stories. Happy99 had none of that polish, and it still circled the planet — proof that a harmful attachment does not need to be clever. It only needs to arrive at the right moment, wearing the right name.

The damage Happy99 caused across two continents

Happy99 destroyed no files. It did not erase family photos, scramble documents, or hold anything for ransom. Compared with the destructive viruses of its time, it was almost gentle. Its harm was of a different kind: traffic, spread, and embarrassment on a huge scale.

As reported at the time, the worm travelled widely through Europe and North America during 1999. Every infected computer became a small, tireless mailing machine. Each message its owner sent quietly produced a second one, so inboxes filled with empty emails and attachments nobody had asked for. Mail systems of that era were far smaller and slower than today’s, and the extra flood clogged them. For internet providers and offices, thousands of unwanted copies were not a joke — they were wasted space, wasted time, and real cleanup work.

There was a social cost too. Imagine having to write to all your friends and explain that the strange empty emails coming from your address were not yours. Imagine being the friend who opened the file because it came right after a trusted message, and then realising your own computer had started sending the same silent packages onward. Happy99 turned ordinary politeness into a delivery network.

Its place in history is secure for a simpler reason: it showed, very early, that email itself could be the road a worm travelled. Before Happy99, most people thought of computer viruses as something passed hand to hand on floppy disks. After Happy99, everyone understood that a virus could arrive through the mailbox, uninvited, dressed for a party.

How to protect yourself from worms like Happy99

The good news is that Happy99’s trick has a clear weakness, and the habits that defeat it still defeat most of its descendants today.

Treat program files from email as strangers at the door. A file ending in .exe is a program, not a picture or a greeting. Real friends send photos as photos. If any email — from anyone — carries a program file, do not run it. This one rule would have stopped Happy99 cold.

Watch for the strange second message. If a real email from a friend is followed by an empty or odd follow-up with an attachment, treat the follow-up as suspicious even though the first message was genuine. The sender’s computer may be sending things without their knowledge, exactly as Happy99 did.

Ask before you open. A quick message costs nothing: “Did you mean to send me this file?” Send that question through a different channel if you can — a phone call or a text. If your friend knows nothing about it, you have just protected yourself and warned them that their machine may be infected.

Be extra careful around celebrations. Happy99 rode on New Year greetings because people lower their guard when a message looks festive. Fake greeting cards, party photos and holiday offers remain favourite costumes for harmful files. Enjoy them as pictures and links to trusted sites — not as programs to download and run.

Keep your protection switched on. Modern email services and security software block most known worms automatically, but they work best when your system and apps are kept updated. Updates close the little doors that worms slip through.

None of this requires fear. It only requires one pause — a single breath between the fireworks and the click.

Common questions

Was Happy99 a virus or a worm?

Happy99 is described as an email worm, and it is also known as Ska. A worm’s main job is to copy itself and spread, and Happy99 did exactly that by secretly attaching itself to follow-up messages whenever its victim sent an email or posted to a discussion group.

Did Happy99 damage people’s files?

No. Happy99 destroyed no files. Its harm came from spreading itself widely across Europe and North America in 1999, filling inboxes and clogging mail systems with silent second messages that nobody had asked for.

Why did people open the Happy99 attachment?

Because it arrived right behind a genuine email from a real friend, and it promised harmless fun. Running it showed fireworks and the words “Happy New Year 1999!!”, so it looked like a greeting card rather than a program installing itself into the computer’s email machinery.

How could you tell a Happy99 email had arrived?

Its tell was the empty follow-up. A normal message from someone would arrive first, and then a second, wordless message would follow carrying only the Happy99.exe attachment. That silent second email was the worm copying itself, sent without the owner’s knowledge.

Can something like Happy99 still reach me today?

The exact worm belongs to 1999, but its method never retired. Program files and harmful attachments still arrive dressed as greetings, photos and urgent documents. The defence is the same pause: never run a program file from email, and check with the sender first — especially when a strange message trails a real one.

Sources

• Wikipedia — Happy99: https://en.wikipedia.org/wiki/Happy99