🚀 go-pugleaf

On Sun, 31 Jan 1999 14:16:46 GMT, dtc@flash.net (Dale) wrote:

>It infected wsock32.dll and 2 other dlls. Norton couldn't repair it,
>had to reload win98. Besides unknowingly attaching it's self to my
>sent e-mail.  Dale

Here's the info on this virus:

Source of this info: 

http://www.avp.ru/english/news/press/990129.html


A New Year Surprise from the Virus Writers!
The first known modern Internet Worm "I-Worm.Happy" was discovered
in-the-wild. This computer worm is a kind of virus program that to
spread its copies does not affect disk files as main target, but
replicates its copies by sending itself to the Internet as an
attachment in the e-mail messages. The worm had been posted by
somebody (maybe by worm author) to several news servers in January
1999, and then in few days it was discovered In-The-Wild in Europe and
continued spreading. 

The worm arrives as an attachment in the e-mails as a HAPPY99.EXE
file. When an infected attachment is executed and gets control, the
worm displays a funny firework in a program's window to hide its
malicious nature. During that, it installs itself into the system,
hooks sendings to the Internet, converts its code to the attachment
and appends it to the messages. As a result the worm, when it is
installed into the system, is able to spread its copies to all the
address the messages are sent to. 

While installing the worm affects files in the Windows system
directory only. It creates the SKA.EXE and SKA.DLL files in there,
copies the WSOCK32.DLL to newly created WSOCK32.SKA and patches the
original WSOCK32.DLL file to hook email sending calls. 

Removal and Protection
If the worm is detected in your system you can easy get rid of it just
by deleting SKA.EXE and SKA.DLL files in the system Windows directory.
You also should delete the WSOCK32.DLL file and replace it with the
WSOCK32.SKA original file. The original HAPPY99.EXE file should be
also located and deleted. 

To protect your computer from re-infection you need just to set
Read-Only attribute for the WSOCK32.DLL file. The worm does not pay
attention to Read-Only mode, and fails to patch the file. This trick
was discovered by Peter Szor at DataFellows
(http://www.datafellows.com).

Please Remember
Do not open and do not execute the HAPPY99.EXE file that you have
received as an attachment in any message, if you get it from an
untrusted source and ever trusted source. You should also remember:
the files that you have got from the Internet can contain malicious
code that may infect your computer, destroy the data, send
confidential files to the Internet, or install spy programs to monitor
your computer from remote host. 

Opening MS Office files with disabled VirusProtection and executing
not trusted executable files is extremely risky. You should remember
about that each time you see an attachment in incoming message. 

Technical Details
The worm arrives as a exactly 10.000 bytes executable HAPPY99.EXE
file. This file has Win32 Portable Executable (PE) internal structure.
The worm installs itself into the Win95/98 systems and continues
spreading with no problems. Under WinNT it is not able to spread
because of bugs. 

The worm contains text strings, some of them are encryped:

 Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999.
 Happy New Year 1999 !!
 begin 644 Happy99.exe end
 \Ska.exe \liste.ska
 \wsock32.dll \Ska.dll \Ska.exe

When the HAPPY99.EXE file is executed, worm copies itself to the
Windows system directory with the SKA.EXE name and drops the
additional SKA.DLL file in the same directory. The SKA.DLL is stored
in the main EXE file (HAPPY99.EXE) in encrypted and lite-packed form. 

The worm then copies the WSOCK32.DLL to the WSOCK32.SKA name (makes a
"backup") and patches the WSOCK32.DLL file. If the WSOCK32.DLL is in
use and cannot be opened for writing, the worm creates a new key in
the system registry to run its dropper during the next rebooting: 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.
EXE
The WSOCK32.DLL patch consists of a worm initialization routine and
two redirected exports. The initialization routine is just a small
piece of worm code - just 202 bytes. It is saved to the end of
WSOCK32.DLL code section (".text" section). The WSOCK32.DLL has enough
of space for that, and the size of WSOCK32.DLL is not increased during
infection. Then the worm patches the WSOCK32.DLL export tables so that
two functions ("connect" and "send") will point to the worm
initialization routine at the end of WSOCK32.DLL code section.

When a user is connecting to the Internet the WSOCK32.DLL is
activated, and the worm hooks two events: connection and data sending.
The worm monitors the email and news ports (25 and 119 - smtp and
nntp). When it detects a connection on one of these ports, it loads
its SKA.DLL library that has two exports: "mail" and "news". Depending
on the port number the worm calls one of these routines, but both of
them create a new message, insert UUencoded worm HAPPY99.EXE dropper
into it, and send to the Internet address. The worm also adds its
stamp to kludge header of "infected" messages: 

 X-Spanska: Yes
While sending infected attachments the worm stores the recipients'
addresses to the LISTE.SKA file in the Windows system directory. This
"log" file contains up to 5K of data, and may contain up to about 200
addresses the infected messages were sent to. 


Nuclear

----------------------------------------------------------------------
This is not about the world that we inherited from our forefathers,
     It is about the world we have borrowed from our children !!
----------------------------------------------------------------------

Rodrigo Carvajal
rcarvaja@udec.cl