|
| |
I-Worm.Happy (AKA
Happy99.exe)
This worm is also known as:
Happy, Happy99, Happy99.exe
This is the first known modern
Internet Worm discovered in-the-wild. This
computer worm is a kind of virus program that to spread its copies does not
affect disk files as main target, but replicates its copies by sending itself
to the Internet as an attachment in the e-mail messages.
The worm had been posted by somebody (maybe by worm author) to several
news servers in January 1999, and then in few days it was discovered
In-The-Wild in Europe and continued spreading. The worm arrives as an
attachment in the e-mails as a HAPPY99.EXE file. When an infected
attachment is executed and gets control, the worm displays a funny firework
in a program's window to hide its malicious nature. During that, it installs
itself into the system, hooks sendings to the Internet, converts its code to
the attachment and appends it to the messages. As a result the worm, when
it is installed into the system, is able to spread its copies to all the address
the messages are sent to.
While installing the worm
affects files in the Windows system directory
only. It creates the SKA.EXE and SKA.DLL files in there, copies the
WSOCK32.DLL to newly created WSOCK32.SKA and patches the original
WSOCK32.DLL file to hook email sending calls.
Removal and Protection
If the worm is detected in your
system you can easy get rid of it just by
deleting SKA.EXE and SKA.DLL files in the system Windows directory.
You also should delete the WSOCK32.DLL file and replace it with the
WSOCK32.SKA original file. The original HAPPY99.EXE file should be
also located and deleted. To protect your computer from re-infection you
need just to set Read-Only attribute for the WSOCK32.DLL file. The
worm does not pay attention to Read-Only mode, and fails to patch the
file. This trick was discovered by Peter Szor at DataFellows
( http://www.datafellows.com ).
Please Remember
Do not open and do not execute
the HAPPY99.EXE file that you have received
as an attachment in any message, if you get it from an unreliable source and
ever trusted source. You should also remember: the files that you have got
from the Internet can contain malicious code that may infect your computer,
destroy the data, send confidential files to the Internet, or install spy
programs to monitor your computer from remote host. Opening MS Office
files with disabled VirusProtection and executing not trusted executable files
is extremely risky. You should remember about that each time you see an
attachment in incoming message.
Technical Details
The worm arrives as a exactly
10.000 bytes executable HAPPY99.EXE
file. This file has Win32 Portable Executable (PE) internal structure.
The worm installs itself into the Win95/98 systems and continues spreading
with no problems. Under WinNT it is not able to spread because of bugs.
The worm contains text strings, some of them are encrypted: Is it a virus,
a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999. Happy New
Year 1999 !! begin 644 Happy99.exe end \Ska.exe \liste.ska \wsock32.dll
\Ska.dll \Ska.exe When the HAPPY99.EXE file is executed, worm copies
itself to the Windows system directory with the SKA.EXE name and drops
the additional SKA.DLL file in the same directory. The SKA.DLL is stored
in the main EXE file (HAPPY99.EXE) in encrypted and lite-packed form.
The worm then copies the WSOCK32.DLL to the WSOCK32.SKA name
(makes a "backup") and patches the WSOCK32.DLL file. If the
WSOCK32.DLL is in use and cannot be opened for writing, the worm
creates a new key in the system registry to run its dropper during the next
rebooting: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\RunOnce=SKA.EXE
The WSOCK32.DLL patch consists of a worm initialization routine and two redirected
exports. The initialization routine is just a small piece of worm
code - just 202 bytes. It is saved to the end of WSOCK32.DLL code section
(".text" section). The WSOCK32.DLL has enough of space for that, and the
size of WSOCK32.DLL is not increased during infection. Then the worm
patches the WSOCK32.DLL export tables so that two functions ("connect"
and "send") will point to the worm initialization routine at the end of
WSOCK32.DLL code section. When a user is connecting to the Internet the WSOCK32.DLL is
activated, and the worm hooks two events: connection and data sending. The worm monitors
the email and news ports (25 and 119 - smtp and nntp). When it detects a connection on one
of these ports, it loads its SKA.DLL library that has two exports: "mail" and
"news". Depending on the port number the worm calls one of these routines, but
both of them create a
new message, insert UUencoded worm HAPPY99.EXE dropper into it, and send to the Internet
address. The worm also adds its stamp to kludge header of "infected" messages:
X-Spanska: Yes While sending infected attachments the worm stores the recipients'
addresses to the LISTE.SKA file in the Windows system directory. This "log" file
contains up to 5K of data, and may contain up to about 200 addresses the infected messages
were sent to.
|
