Worm/Happy.A - Worm

See also

Full description

Alias:	Happy99, I-Worm.Happy, W32/Ska.dll, W32/Ska.dll@m
Type:	Worm
Size:
Origin:
Date:	00-00-0000
Damage:	Sent by email.
VDF Version:
Danger:	Low
Distribution:	Low

DistributionThe email sent by the worm has the attachment:Happy99.EXE.

Technical DetailsWhen activated, Worm/Happy.A displays the message "Happy New Year 1999!!" and fireworks on the screen.

It can spread through email attachments or using its own SMTP engine for sending emails. Such an email is followed by a second one, with the attachment:

>X-Spanska: Yes
>
>begin 644 Happy99.exe
>M35I0`
`(````$``\`__\``+@`````````0``:````````````````````````
>M``````````````````````$``+H0``X?M`G-(;@!3,TAD)!4:&ES('!R;V= R

When the attachment HAPPY99.EXE is opened, the worm is copied in %WinDIR%\%SystemDIR% as SKA.EXE.

Then, it checks if WSOCK32.SKA exists in %WinDIR%\%SystemDIR%. If it doesn't, but there is an WSOCK32.DLL file, the worm copies the file WSOCK32.DLL into WSOCK32.SKA.

The worm makes the registry autostart entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Ska.exe = Ska.exe

See a brief description here.

Description inserted by Crony Walker on Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back