X-Spanska: Yes
but this is normally not visible.
It does not modify any other file besides WSOCK32.DLL. WSOCK32.DLL is a
regular part of Windows that provides a
connection to the Internet. If it is unable to modify WSOCK32.DLL, then it
will add SKA.EXE to the RunOnce section of
the registry and WSOCK32.DLL will be modified next time the computer starts.
It will still create WSOCK32.SKA even if it is
unable to modify WSOCK32.DLL. This virus will keep a list of message
recipients in the file LISTE.SKA in the Windows
System folder. It will try not to send the Happy99.exe file twice to the
same person. The size of SKA.EXE (and
HAPPY99.EXE) is 10,000 bytes. The size of SKA.DLL is 8,192 bytes.
This virus does not steal passwords, as some sources have reported. It does
not contain any payload other than the fireworks
display. However, it could overload an e-mail server if a lot of copies get
passed around. Also, since it gets passed along a lot,
a different virus could attach to HAPPY99.EXE somewhere along the way.
Without SKA.DLL and SKA.EXE, the modified
WSOCK32.DLL cannot perform any viral action. However using a modified
WSOCK32.DLL could cause problems while on
the Internet. The most common problem that has been reported is invalid page
faults, but these can have other causes. Restoring
the original WSOCK32.DLL will correct these problems.
This virus does not affect Macs, DOS, Windows 3.x, OS/2, Linux or WebTV.
However, someone using one of those could
pass it along manually, for example by forwarding the message. Under Windows
NT it will create SKA.EXE, SKA.DLL, and
WSOCK32.SKA but will fail to add itself to the registry or modify
WSOCK32.DLL. If you have NT, you don't have to
follow the removal steps; you can simply delete SKA.DLL, WSOCK32.SKA and
SKA.EXE from inside Windows NT if
you would like. This virus is not able to infect WSOCK32.DLL if it has the
read-only attribute. Setting the read-only attribute
after being infected is useless. I caution you not to run HAPPY99.EXE even
if WSOCK32.DLL is read-only. Since it has
passed through so many computers, a different virus could attach to
HAPPY99.EXE along the way.
Some people have asked whether it is always called HAPPY99.EXE. This virus
doesn't contain any code to change the name.
However, it would be simple for a person to change it to anything they like.
It contains the encrypted text:
"Is it a virus, a worm, a Trojan? MOUT-MOUT Hybrid (c) Spanska 1999."
Spanska is the alias of a virus writer who has written several other
viruses.
Is it a virus, a worm, or a Trojan? (Technical Discussion)
Removal
There are some automatic cleaners for this virus here or you could do it
manually. Steps marked optional are not absolutely
necessary and are completely safe to skip. If you're not comfortable with
DOS, get someone knowledgeable to help you with
this. These steps should be safe, even under unexpected circumstances, but I
can't make guarantees. Perform these at your own
risk. If you have Windows NT, you don't have to follow the removal steps.
If your not sure whether you are infected or not, then perform step 10 to
check if you're clean.
1.Click Start, then Shut Down, then "Restart Computer in MS-DOS mode",
then click Yes. It's important to exit Windows
in order to be able to replace the file WSOCK32.DLL which Windows
normally has in use.
2.At the DOS prompt type these commands exactly and press enter at the
end of each line:
CD \WINDOWS\SYSTEM
If that doesn't work, try
CD SYSTEM
3.Delete SKA.EXE and SKA.DLL by typing
DEL SKA.EXE
DEL SKA.DLL
If you get "File not found" you're either not infected or in the wrong
directory. Make sure you're in your Windows
System directory; check to see if you followed step 2 exactly. You can
continue following the instructions even if you get
"File not found". It can't hurt to keep on following the instructions.
4.Copy WSOCK32.SKA to WSOCK32.DLL by typing
ATTRIB -R WSOCK32.DLL
COPY WSOCK32.SKA WSOCK32.DLL
The ATTRIB command is just in case WSOCK32.DLL has been made read-only
since the infection. Answer "Yes" if it
asks if you want to overwrite WSOCK32.DLL. Explanation: WSOCK32.SKA is
a backup of the original
WSOCK32.DLL. You are replacing the modified DLL with the original. If
you get a "Sharing violation" make sure you
followed step 1.
5.Optional Delete WSOCK32.SKA by typing
DEL WSOCK32.SKA
You can leave WSOCK32.SKA on your system. It is a copy of your original
WSOCK32.DLL Do not delete
WSOCK32.SKA if you are unable to replace WSOCK32.DLL with WSOCK32.SKA.
6.Return to Windows by typing
EXIT
7.Optional Click Start, then Run, then type regedit in the text box, then
click OK. Click HKEY_LOCAL_MACHINE,
then Software, then Microsoft, then Windows, then CurrentVersion. Under
RunOnce check for SKA.EXE and select it
if it is there. Press delete and then click Yes. Close Regedit. Don't
change anything else without making a backup of the
registry first. If you don't find SKA.EXE in the registry, it doesn't
mean you're not infected. SKA.EXE is only added to
the registry if HAPPY99.EXE is unable to modify WSOCK32.DLL when you
run it. Also, you'll only find it in the
registry if you haven't rebooted since you ran HAPPY99.EXE.
8.Optional Choose Start, Programs, Accessories, Notepad, choose File,
then Open then type
C:\WINDOWS\SYSTEM\LISTE.SKA in the File Name box. Warn the people on
the list, then delete LISTE.SKA.
Make it clear to the people you warn that they won't be infected unless
they ran happy99.exe, to avoid alarming them
unnecessarily. If you haven't sent out any infected e-mails, there
won't be a LISTE.SKA.
9.Optional Delete the HAPPY99.EXE file. The location of HAPPY99.EXE will
vary depending on where you saved it.
You can delete it simply by dragging it to the Recycle Bin from within
Windows or whatever method you prefer. You
may still have some messages with HAPPY99.EXE attached in your mailbox.
These cannot do anything unless you run
them. You can delete them if you want to or just ignore them.
10.Optional If you aren't sure whether you are infected, choose Start,
then Find, then "Files or Folders". Then type
WSOCK32.DLL in the "Named" box. In the "Look in" box choose drive C: or
whatever drive you have Windows on.
In the "Containing Text" box type "ska.dll" without the quotes. Then
click "Find Now". If you don't find any files,
that means that WSOCK32.DLL isn't the modified version. If you don't
have the modified WSOCK32.DLL, the virus
has no way to attach to e-mails, even if you have SKA.EXE, SKA.DLL, or
WSOCK32.SKA in the Windows System
folder. If you have SKA.EXE in the RunOnce registry section, and you
haven't deleted SKA.EXE, then the virus will try
to modify WSOCK32.DLL the next time you restart the computer. If you
would like to check if SKA.EXE is in the
registry, then do step 7. If you don't have the modified WSOCK32.DLL,
and SKA.EXE isn't in the registry, the virus is
completely inactive and is effectively removed.
----- Original Message -----
From: Nigel Howie <howie@voyager.co.nz>
Sent: Thursday, December 23, 1999 5:07 AM
Subject: HAPPY XMAS
>
>
> -------------------------------------------------------------
> To leave this list, email <listserver@keelynet.com>
> with the body text: leave Interact
> list archives and on line subscription forms are at
> http://keelynet.com/interact/
> -------------------------------------------------------------
>
-------------------------------------------------------------
To leave this list, email <listserver@keelynet.com>
with the body text: leave Interact
list archives and on line subscription forms are at
http://keelynet.com/interact/
-------------------------------------------------------------