HAPPY99 hybrid (c) 1999 by Spanska.

[First version of this file written in January 1999, revised for 29A in January 2000]
[Best viewed in WordPad, not in Word, especially for paragraph 3]

[dedicated to VicodinES, a great guy. Take care, my friend, wherever you are.]

1.	Introduction
2.	How does the dropper work?
3.	How can it modifies outgoing mail/news messages ?
4.	How can I find more information ?
5.	How can I compile it ?
6.	What are all the files in this zip ?
7.	Technical analyse by Peter Szor (F-Prot website)
8.	Technical analyse by Kaspersky's lab (AVP website)
9. 	An interesting paper published in Virus Bulletin by Peter Szor

	1. Introduction

It's like a virus because it infects wsock32.dll.
It's like a worm because it spreads using mail and news connections.
It's like a trojan because it hides its nature and requires some user help.

I designed this piece of code starting from an obvious observation: nowadays, people exchange more internet messages than programs or disks. If our goal is the number of in-the-wild infections, I think we all have to rethink the classical infecting scheme. The minimal infection unit is no more a program, it's a connected computer. No need to infect 500 files on one computer. One is enough. Think about all the newcomers on the internet who bought a computer for Christmas, and who know nothing about safe computing. These perfect victims form a network big enough to ensure a critical mass for a massive infection. I really think internet-aware viruses are the future of auto-reproducing programs. Indeed, 1999 was the Year of the Worms. 

It's not designed to destroy anything on infected hosts. It's just a sympathetic hitchhiker who uses your internet connection to travel, and thank you for the trip with a small animation. I even tried to make this worm very easy to remove for an average user without an anti-virus, which is in contradiction with general rules of virus writing. I can say that Happy was an experimental piece of code, which happened to work surprisingly well, even more that I could think.

At the time I write this, Happy99 is one year old, and the funny thing is that it continues to spread, although at a much slower rate. It's really fascinating to think that all the infections started with just 4 or 5 mails at the very beginning, to poor victims carefully choosen after one week studying their behavior in a newsgroup/chat where they were regulars (basically, for their low computer knowledge, curiosity, and the fact they liked to exchange electronic postcards or jokes: it was very easy then to force them to execute Happy with some basical social engineering). Sometimes I would like to know the big infection tree, how new branches came out and developed, what were the exchanged e-mails or posts each time, and what was the whole infection network that made his little joker came back to me several time. It's fascinating to think that Happy travels when ideas are exchanged by people through the world. It's like a little piece of wood just deriving the information flow, following all the channels. You may laugh, but I find this very poetic.

It demonstrates one other thing. Viruses does not need to be very complex to be efficient. Happy99 is very simple, technically speaking. No encryption, no polymorphism, no complex way to stay in memory, no state-of-the-art tricks. Basically, it's just a stupid .dll, placed in the system by a dropper which hooks some wsock32 APIs. That's all.

This is not the first modern internet-aware virus (I say "modern" to exclude the big old ones like the fabulous Morris Worm in 1988). Some of them were (before january 1999, of course, there were plenty after):

Macro viruses:

Macro.Word.Sharefun (?, 1997): send itself by e-mail using MS Mail
Macro.Word.Innuendo (?, 1998): send itself by e-mail 
Macro.Word.Agent (Lord Natas/CodeBreakers, 1998): post itself to several newsgroups by using Forté Agent
Macro.Word97.Antimarc (Lord Natas/CodeBreakers, 1998): send itself by e-mail using Outlook and by IRC using mIRC
Macro.Word97.Caligula (Opic/CodeBreakers, 1998): send stolen PGP keyfiles to the CodeBreakers FTP

File viruses:

Win.Homer (Kernel Panik, 1997): intercept FTP connection and upload itself in "/incoming" directory, written in C++
Win.RedTeam (The Soul Manager, 1997): add itself in the outgoing mail Eudora database
Win32.Inca (Vecna/29A, 1998): can send itself by IRC using mIRC
Win32.Parvo (Griyo/29A, 1998): find an e-mail adress by searching Usenet articles, and send itself to this adress without the help of a mail client

In this list, the most exciting viruses for me in term of net spreading (not talking about complexity because the winner is Inca) were ShareFun because it was the first one to use internet, Agent because of it was the first to post to newsgroups, and Parvo because it's the first to spread through internet without the help of another client program. Actually, I met some good coders, including Griyo, in Madrid in summer of 1998, and when he told me in a bar that his new virus could communicate by directly contacting SMTP servers, I instantly thought "Eureka, that's the way!" (even if I was a bit drunk).

By the way, if you want to know why it was called Mout-Mout, just ask my girlfriend.

Last word of introduction: I know you don't care, but please don't use this code to produce anything destructive. Because 1) code stealing is lame and 2) destruction is lame. Ask T-2000 about that. If you're 12-years old like him, during your teen crisis, and you just want to fuck the world and destroy all the powerful companies, please remember one thing. Computer viruses, just as their biological counterpart, are instrument of social inequalities. What does it means? That a rich guy with a cancer has a higher probability to survive than a poor guy with a cancer, because he will get better prevention, better care and better treatment. That's the same with computer viruses. Compagnies don't care about your stupid destructive routine, they have automatic backups every night, good network protection, good antivirus, they can pay good prices for data recovery, etc... Think about that. And then, create non-destructive viruses.

[if you want to contact me, post a message in alt.comp.virus] 

	2. How does the dropper work?

The infection process is basic. When you execute the happy99.exe dropper, it first copies itself under the name ska.exe in the system directory. It then decompresses the ska.dll and creates it in the system directory too.

Before modifying wsock32.dll, it makes a clean backup copy of it under the name wsock32.ska. Cool, no? Then it hooks the 2 APIs "connect" and "send", and redirect them to the free space at the end of the .text section. Here, it inserts a tiny piece of code. A call to "connect" (for mail or news), which is one of the first during a connexion, will load the ska.dll and return. A call to "send" will call one of the 2 functions (mail or news) inside the ska.dll, depending on the port number (respectively 25 or 119), and return.

At the end, it displays a fireworks (thanks to Picard/Hydrogen, great demo coder: i adapted to win32 and to my needs the very realistic and beautiful algo he used in a 256 bytes demo).

If wsock32.dll is in use and so cannot be modified, it changes the registry to let ska.exe execute at next windows boot. Note that the fireworks will not be displayed in this case.

	3. How can it modifies outgoing mail/news messages ?

When you connect to a server (SMTP or NNTP in this case), your client (Eudora, Netscape...) starts a dialog with this server. It sends and receives information. As we hook the "send" function, we can monitor what information is sent, because the offset of the send buffer and its length are on the stack. We store some of this info, especially the recipients mail addresses. Then, when the client wants to send the normal message, we replace it by an on-the-fly uuencoded dropper under the name "Happy99.exe", and send a "end of message" signal, which is just a simple point ("."). Because I'm really a good guy, I then use the stored recipient mail addresses to send the normal message. This is why the Happy99.exe is received by victims before the normal message. 

Let's try to resume it all, using the chronological list of sent information (I snipped some non-important winsock API calls and simplified a bit). On the left, it's the normal information dialog during the connection to the server. On the right, it's the new dialog added by the worm and things he does. In red are the winsock APIs called. In blue is the sent information. In grey is the received information. Note that the socket number used in this case is 21. This log was created with WSOCK32SPY during a connection to send a mail, and then edited by hand.

[WSAStartup (0)]
[WSAAsyncGetHostByName: mailserver.com (1)]
[socket: (21)]
[21:connect: XXX.XXX.XXX.XXX.25(-1)]			<= CONNECTION PORT 25:SKA.DLL IS LOADED
[21:recv: completed (85)]220 mailserver.com ESMTP 
Sendmail 8.8.8/8.8.8; Sat, 19 Dec 1998 02:39:16 
+0100 (MET)
[21:send:(33)]HELO my.computer.com
[21:recv: completed (90)]250 mailserver.com Hello 
my.computer.com [XXX.XXX.XXX.XXX], pleased to meet 
you
[21:send:(6)]RSET
[21:recv: completed (17)]250 Reset state
[21:send:(34)]MAIL FROM:<victim@computer.com>		<= STORE SENDER IN MEMORY 
[21:recv: completed (41)]250 <victim@computer.com>
... Sender ok
[21:send:(32)]RCPT TO:<nextvictim@somewhere.com>		<= STORE RECIPIENT IN MEMORY
[21:recv: completed (44)]250 <nextvictim@somewhere.com>
... Recipient ok
[21:send:(6)]DATA
[21:recv: completed (50)]354 Enter mail, end with "." 
on a line by itself
[21:send:(776)] 	
<= INTERCEPT BEFORE IT'S SENT AND THEN:
- CHECK HEADER AND STORE IMPORTANT FIELDS 
(FROM, SUBJECT, NEWSGROUPS, CC, BCC)
- SEND A NEW RECONSTRUCTED HEADER THAT USES 
STORED FIELDS, BY CALLING ORIGINAL WINSOCK API
- UUENCODE THE DROPPER IN MEMORY
- SEND THE DROPPER
- SEND A END SIGNAL (A POINT)

[21:send:(header_size)] 
To: nextvictim@somewhere.com
From: The Poor Victim <victim@computer.com>
Subject: Hello !
X-Spanska: Yes
[21:send:(uuencoded_size)] 
begin 644 Happy99.exe
M7$L#t!0``@`(s`I[DB74S4T*&00``(<*5`=75E;F- 
<. . .uuencoded_dropper. . .>
M4$L%g@``M``!``$0.@`p`$,$````
!``#_
`
end
[21:send:(5)]
.
[21:recv: completed (44)]250 EAA12714 Message accepted 
for delivery

; NOW PREPARE THE SENDING OF THE NORMAL MESSAGE 
; USING THE STORED DATA

[21:send:(6)]RSET
[21:recv: completed (17)]250 Reset state
[21:send:(34)]MAIL FROM:<victim@computer.com>
[21:recv: completed (41)]250 <victim@my.computer.com> ... Sender ok
[21:send:(32)]RCPT TO:<nextvictim@somewhere.com>
[21:recv: completed (44)]250 <nextvictim@somewhere.com>
... Recipient ok
[21:send:(6)]DATA
[21:recv: completed (50)]354 Enter mail, end with "." 
on a line by itself

; NOW WE CAN GIVE CONTROL BACK TO MAIL PROGRAM
AND LET HIM SEND THE NORMAL MESSAGE

Message-Id: <55.19981219.016cbd28@mailserver.com>
X-Sender: victim@my.computer.com (Unverified)
X-Mailer: Windows Eudora Light Version 3.0.4 (32)
Date: Sat, 19 Dec 1998 02:39:16 +0100
To: nextvictim@somewhere.com
From: The Poor Victim <victim@my.computer.com>
Subject: Hello !
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

How are you, my friend?
Have you seen the new Babylonia virus? 
I've heard it was coded by a brazilian porn actor!
Incredible, no?
See ya on #teensex
[21:send:(5)]
.
[21:recv: completed (44)]250 EAA12714 Message accepted 
for delivery
[21:send:(6)]QUIT
[21:closesocket: (0)]
[WSACleanup:(0)]

The same thing, even simpler because the dialog client/server is shortened, happens during a connection to a news server and an outgoing post to a newsgroup.

A last thing to say is that the worm does not send itself twice to the same address, by comparing with a list stored in the system directory, called liste.ska.

	4. How can i find more information ?

About wsock32.dll APIs, look at the winsock or winsock2 help files
To produce logs of winsock APIs calls, use programs like WSOCK32SPY (freeware)
About mail message structure, look at RFC 822
About mail client/server dialogs (SMTP), look at RFC 821
About news message structure, look at RFC 1036
About news client/server dialogs (NNTP), look at RFC 977

	5. How can I compile it ?

I removed in this package all the tools needed for an easy compilation. This source is here for you to understand how Happy99 works, not to produce a bunch of easily done Happy hacks. By the way, when I saw the number of infections in the wild at the beginning, I decided not to distribute the source at all, even to close friends, because you never know what can happen. Some stupid coder can add a destructive routine to your code. During one year, I kept it for myself. Well, now, one year later, it's no more that important. 

	6. What are all the files in this zip ?

Readme.rtf	You're reading it

Ska_dll.asm	The dll (ska.dll during infection)
Ska_exe.asm	The dropper (Ska.exe when installed, Happy99.exe when sent)

Fireworks.asm	The graphic effect routine source
Fireworks.exe	The graphic effect routine alone

	7. Technical analyze by Peter Szor (F-Prot website)

NAME: Win32/Ska.A
ALIAS: Happy99, WSOCK32.SKA, SKA.EXE, I-Worm.Happy
SIZE: 10000

Win32/Ska.A is a Win32-based worm. It displays fireworks when executed
first time as happy99.exe. (Normally this file arrives as an e-mail attachment
to a particular PC, or it is downloaded from a newsgroup.) 

When executed first time, it creates SKA.EXE and SKA.DLL in the system
directory. SKA.EXE is a copy of HAPPY99.EXE. SKA.DLL is packed inside
SKA.EXE. After this Ska creates a copy of WSOCK32.DLL as WSOCK32.SKA
in the system directory. Then it tries to patch WSOCK32.DLL so that its export
entries for two functions will point to new routines (to the worm's own
functions) inside the patched WSOCK32.DLL. If WSOCK32.DLL is in use,
Ska.A modifies the registry's RunOnce entry to execute SKA.EXE during next
boot-up. (When executed as SKA.EXE it does not display the firework, just
tries to patch WSCOK32.DLL until it is not used.) 

"Connect" and "Send" exports are patched in WSOCK32.DLL. Thus the worm
is able to see if the local user has any activity on network. When "Connect" or
"Send" APIs are called, Ska loads its SKA.DLL containing two exports: "news"
and "mail". 

Then it spams itself to the same newsgroups or same e-mail addresses where
the user was posting or mailing to. It maps SKA.EXE to memory and converts
it to UU encoded format and manipulates the mail buffer to contain this UU
encoded attachment as happy99.exe. 

Therefore it is not limited like Win32/Parvo which is unable to use a particular
news server when the user does not have access to it. The worm also
maintains a list of addresses it has posted a copy of itself. This is stored in a
file called LISTE.SKA. (The number of entries are limited in this file.) 

The worm contains the following encrypted text which is not displayed: 

"Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999." 

The mail header of the manipulated mails will contain a new field called

"X-Spanska: YES"

Since the worm does not check WSOCK32.DLL's attribute, it can not patch it if
it is set to read only. 

	8. Technical analyze by Kaspersky's lab (AVP website)

I-Worm.Happy

This computer worm is a kind of virus program that does not affect files to spread its copies, but just sends itself to the Internet as an attachment in the e-mail messages. The worm had been posted by somebody (maybe by virus author) to several news servers, and on next day Kaspersky labs got the report that it was discovered In-The-Wild in Europe and continued spreading. We have no reports from USA and other countries yet. 

The worm arrives as an attachement in the e-mails as HAPPY99.EXE file. 

Note: the affected sender does not know that the worm appends attachements on sending. 

When an infected attachement is executed and gets control, the worm displays a funny firework in a program's window to hide its malicious nature. 

During that, it installs itself into the system, hooks sendings to the Internet, converts its code to the attachment and appends it to the messages. As a result the worm, when it's installed into the system, is able to spread its copies to all the address the messages are sent to. 

Removal and Protection

If the worm is detected in your system you can easy get rid of it just by deleting SKA.EXE and SKA.DLL files in the system Windows directory. You also should delete the WSOCK32.DLL file and replace it with the WSOCK32.SKA original file. The original HAPPY99.EXE file should be also located and deleted. 

To protect your computer from re-infection you just need to set the Read-Only attribute for the WSOCK32.DLL file. The worm does not pay attention to Read-Only mode, and fails to patch the file. This trick was discovered by Peter Szor at DataFellows (http://www.datafellows.com). 

Technical Details

The worm arrives as a exactly 10.000 bytes executable HAPPY99.EXE file. This file has Win32 Portable Executable (PE) internal structure. The worm installs itself into the Win95/98 systems and continues spreading with no problems. Under WinNT it is not able to spread because of bugs. 

The worm contains text strings, some of them are encryped: 

 Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999.
 Happy New Year 1999 !!
 begin 644 Happy99.exe end
 \Ska.exe \liste.ska
 \wsock32.dll \Ska.dll \Ska.exe

When the HAPPY99.EXE file is executed, the worm copies itself to the Windows system directory with the SKA.EXE name and drops the additional SKA.DLL file in the same directory. The SKA.DLL is stored in the main EXE file (HAPPY99.EXE) in encrypted and lite-packed form. 

The worm then copies the WSOCK32.DLL to the WSOCK32.SKA name (makes a "backup") and patches the WSOCK32.DLL file. If the WSOCK32.DLL is in use and cannot be opened for writing, the worm creates a new key in the system registry to run its dropper during the next rebooting: 

HKEY_LOCAL_MACHINE
\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE

The WSOCK32.DLL patch consists of a worm initialization routine and two redirected exports. The initialization routine is just a small piece of worm code - just 202 bytes. It is saved to the end of WSOCK32.DLL code section (".text" section). The WSOCK32.DLL has enough of space for that, and the size of WSOCK32.DLL is not increased during infection. Then the worm patches the WSOCK32.DLL export tables so that two functions ("connect" and "send") will point to the worm initialization routine at the end of WSOCK32.DLL code section. 

When a user is connecting to the Internet the WSOCK32.DLL is activated, and the worm hooks two events: connection and data sending. The worm monitors the email and news ports (25 and 119 - smtp and nntp). When it detects a connection on one of these ports, it loads its SKA.DLL library that has two exports: "mail" and "news". Depending on the port number the worm calls one of these routines, but both of them create a new message, insert UUencoded worm HAPPY99.EXE dropper into it, and send to the Internet address. The worm also adds its stamp to kludge header of "infected" messages: 

 X-Spanska: Yes

While sending infected attachments the worm stores the recipients' addresses to the LISTE.SKA file in the Windows system directory. This "log" file contains up to 5K of data, and may contain up to about 200 addresses the infected messages were sent to.

	9. An interesting paper published in Virus Bulletin by Peter Szor

Win32/Ska: Happy Gets Lucky?
Péter Ször 
Data Fellows 
Virus Bulletin, April 1999

Virus writers want their creations to spread as far and as fast as possible. Several of them have attempted to use the Internet to achieve this goal. A few years ago they simply tried to spam infected files to newsgroups. While very few were really successful in this, some of them became infamous because of it, especially a French virus writer called Spanska. His early DOS creations even became inthe-wild viruses. 

Spanska's strategy was much better than average when it came to spreading his viruses. He posted infected hack programs to certain newsgroups which could be used to register commercial products. Thousands of people look for such hacks on the Internet every day, infecting their computers with the attached virus. Unfortunately, this all happened in the past_the present is automation. 

More and more viruses are written with built-in network features. Win32/Parvo (see VB, January 1999, p.7) was the first virus which could spam hoax messages with infected attachments by using socket communication. Parvo was not very successful due to certain limitations. 

We knew Parvo was the first, but would not be the last, of its kind. During January 1999, Spanska's new creation, Win32/Ska, became well-known by thousands of Internet users the world over. 

It is not particularly easy to classify Ska. While most virus researchers agree that it is a worm, others, including myself, have some doubts about this. The fact is that Ska cannot be classified as a real virus and it is not a traditional worm either. The general consensus is that its working mechanism shows more similarities with worms. 

Ska gets inside a computer via an email or newsgroup attachment, affecting those machines that run the attachment. If an unauthorized attachment called HAPPY99.EXE is run, Ska puts up an attractive fireworks display, which could easily be mistaken for a good-looking accessory to the message. However, when the fireworks burst on-screen, Ska has already modified the WSOCK32.DLL file (if it was available for access) in order to monitor all postings that are made from the machine. All Internet access goes through APIs placed in the WSOCK32.DLL. 

Afterwards, Ska spams the newsgroup or email recipient with copies of itself any time the user tries to send a message across cyberspace. Two messages are posted from the machine each time _ the original mail and a copy of it with a UU-encoded attachment called HAPPY99.EXE which goes to the same location. This attachment is exactly 10,000 bytes long when decoded. 

Ska shares many similarities with chain letters. Chain letters are classified as worms. When someone receives a chain letter with attachments (most often a script), the executed attachment can look for other email addresses and post itself to those places without modifying anything on the local machine. Ska works that way, with one important difference. It modifies a local DLL in order to get control later. It does this by modifying the WSOCK32.DLL file (it does not patch the DLL in memory). Therefore, rebooting the attacked PC will not remove Ska from the machine. 

Executing HAPPY99.EXE 

In the first stages, a user receives two messages similar to the ones we have seen on samples@datafellows.com: 

Date: Fri, 26 Feb 1999 09:11:40 +0100 (CET) 
From: "XYZ" <xyz@xyz.cz> 
Subject: VIRUS 
X-Spanska: Yes 

Note the `X-Spanska: Yes' in the header. This is added by Win32/Ska. Everything beginning with X- is simply skipped by the mail servers. The body of the mail is a UU-encoded attachment. 
The original message reads: 

From: "XYZ" <xyz@xyz.cz> 
To: <samples@datafellows.com> 
Subject: VIRUS 
Date: Fri, 26 Feb 1999 09:13:51 +0100 
X-MSMail-Priority: Normal 
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 
HAPPY NEW YEAR 1999. 
I delete the attachment but it seems to still block my computer. 
What can I do. Thanks for your reply 

When the user executes HAPPY99.EXE, Ska is activated.

Initially, it allocates memory for its own use. If that should fail, Ska will terminate immediately. After that, it checks if the system is Win32-compatible and terminates if it is not. Then it decrypts a short encrypted area of itself which contains the following text: 

Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999. 

After this, it gets the exact location of HAPPY99.EXE and copies it into the Windows system directory as SKA.EXE, unpacking an area into the previously allocated buffer. The unpacked code is used to create SKA.DLL (8192 bytes) in the Windows system directory. This DLL has two exported APIs_`mail' and `news', respectively. 

Next, it makes a copy of WSOCK32.DLL, renaming it WSOCK32.SKA in the Windows system directory and tries to open WSOCK32.DLL for write. Ideally this is possible if the DLL file is not set to read-only and it is not in memory. Ska does not handle the read-only flag_setting the file to read-only can save WSOCK32.DLL from the patching. If the DLL is in memory, the file cannot be opened, and Ska tries to modify the registry field ...CurrentVersion\RunOnce to execute SKA.EXE from there during next boot (when WSOCK32.DLL will not be loaded). If WSOCK32.DLL is not in memory yet, then Ska tries to patch it. 

It checks if WSOCK32.DLL is already patched by comparing the checksum field of the DOS EXE header to 7Ah. (If the checksum is not 7Ah it sets it to this value which is its self-recognition mark). Then it searches over the section table and makes the necessary modification. It sets the .text section to writeable and makes the virtual size of it a little bigger. This is in order to fit in there, in the section slack, with its short hook routines at the end of the .text section. Then it searches for two API names in the WSOCK32.DLL export sections. These are called `connect' and `send'. It patches the export address entries of these APIs to point to new entries at the end of the .text section. 

Next, it gets the address of a few APIs and saves pointers to the entry point of those functions which will be used later. Finally, it patches a very short routine at the end of the .text section in WSOCK32.DLL. Then the patch is ready. After this, Ska calls the message box animation routine, but only if HAPPY99.EXE was executed. If the SKA.EXE copy is executed from boot, the animation is not displayed. 

Posting a Message 

When the patched WSOCK32.DLL is loaded in memory Ska intercepts the `connect' and `send' APIs. When the user makes a connection to anywhere, Ska checks the ports utilized. If it is mail or news port access Ska loads the SKA.DLL in memory. When a DLL is loaded, its initialization entry point is called. In this initialization routine another encrypted area is decrypted in the SKA.DLL which is related to the uu-encoding and a large enough buffer is allocated for future use. At that point, the original `connect' entry point is called from WSOCK32.DLL. 

When the intercepted `send' is called, Ska re-checks if the sending is news- or mail-related by getting the addresses of `news' or `mail' APIs from SKA.DLL and calling them first. It copies part of the original email header to a new buffer, paying attention to `NEWSGROUPS:', `MAIL FROM:' , `TO:', `CC' and `BCC' and copying them for its own use. Finally, it adds the `X-Spanska: Yes' string to the existing mail header. 
It opens SKA.EXE and converts it into uu-encoded form in between the `begin 644 Happy99.exe' and `end' lines which marks the uu-encoded attachment. It posts this mail to the specified location. After this the original `send' request is called which posts the original message without the HAPPY99.EXE attachment. 

Ska logs the addresses where it could post itself. A text file called LISTE.SKA is created for that use in the Windows system directory. This text file will list a limited number of locations where Ska could post itself successfully. 

Conclusion 

We are bound to see more and more viruses and worms capable of posting themselves all over the place. That means a new challenge for anti-virus researchers. 

Very often we have to spend hours, days or a full week with some creations until we can provide a solution. Virus writers create something new again in a couple of months. The typical user wants a 24-hour solution. Always difficult, this is becoming even more challenging this year, especially when users still insist on executing uncertified attachments received from their `friends'. 

Win32/Ska 

Aliases: Happy99, SKA.A, I-Worm.Happy, MOUT-MOUT. 
Type: Win32 worm. 
Self-recognition in WSOCK32.DLL: 
Sets the checksum field of the DOS EXE header to 7Ah. 
Hex Pattern in WSOCK32.DLL and HAPPY99.EXE: 
3319 7508 8B44 2428 AA47 EB0A 3C77 751B 478B 4424 28AA E808 0000 0053 6B61 2E64 
Intercepts: Hooks Send and Connect APIs of WSOCK32.DLL. 
Payload: When executed as HAPPY99.EXE, it displays fireworks animation. 
Removal: Delete SKA.EXE and SKA.DLL and replace WSOCK32.DLL with WSOCK32.SKA in the Windows systems directory

--------------------------- © Spanska 2000 ---------------------------------