Find a Partner
This window is encrypted for your security.
Need help? Ask the community or hire an expert.
Go to Avira Answers
Happy99, I-Worm.Happy, W32/Ska.dll, W32/Ska.dll@m, W32/Ska@M
Sent by email.
The email sent by the worm has the attachment:Happy99.EXE.
When activated, Worm/Happy displays the message "Happy New Year 1999!!" and fireworks on the screen.
It can spread through email attachments or using its own SMTP engine for sending emails. Such an email is followed by a second one, with the attachment:
>begin 644 Happy99.exe
When the attachment HAPPY99.EXE is opened, the worm is copied in %WinDIR%\%SystemDIR% as SKA.EXE.
Then, it checks if WSOCK32.SKA exists in %WinDIR%\%SystemDIR%. If it doesn't, but there is an WSOCK32.DLL file, the worm copies the file WSOCK32.DLL into WSOCK32.SKA.
The worm makes the registry autostart entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ska.exe = Ska.exe
Description inserted by Crony Walker on Tuesday, June 15, 2004