Virus Database

I-Worm.Happy

Description I-Worm.Happy

This is the first known modern Internet Worm discovered "in the wild." This computer worm is a kind of virus program that, while spreading its copies, does not infect disk files as the main target, but replicates its copies by sending itself via the Internet as an attachment in e-mail messages. The worm was posted by somebody (maybe by the worm's author) to several news servers in January 1999, and then in few days, it was discovered "in the wild" in Europe and continued spreading.
The worm arrives as an attachment in an e-mail as a HAPPY99.EXE file. When an infected attachment is executed and gains control, the worm displays a funny firework in the program's window to hide its malicious nature. During this, it installs itself in the system, hooks sendings to the Internet, converts its code to the attachment and appends it to the messages. As a result the worm, when it is installed into the system, is able to spread its copies to all the addresses the messages are sent to.
While installing, the worm affects files in the Windows system directory only. It creates the SKA.EXE and SKA.DLL files in there, copies the WSOCK32.DLL to the newly created WSOCK32.SKA and patches the original WSOCK32.DLL file to hook e-mail sending calls.
Removal and Protection
If the worm is detected in your system, you can easily get rid of it just by deleting the SKA.EXE and SKA.DLL files in the system Windows directory. You also should delete the WSOCK32.DLL file and replace it with the WSOCK32.SKA original file. The original HAPPY99.EXE file should also be located and deleted.
To protect your computer from re-infection, you need only set the "Read-Only" attribute for the WSOCK32.DLL file. The worm does not pay attention to the Read-Only mode, and fails to patch the file. This trick was discovered by Peter Szor at DataFellows (http://www.datafellows.com).
Please Remember
Do not open and do not execute the HAPPY99.EXE file that you have received as an attachment in any message if you receive it from an untrusted or unknown source. You should also remember that the files you have accessed from the Internet can contain malicious code that may infect your computer, destroy data, send confidential files to through the Internet, or install spy programs to monitor your computer from a remote host.
Opening MS Office files with disabled VirusProtection and executing untrusted executable files is extremely risky. You should keep this in mind each time you see an attachment to incoming message.
Technical The worm arrives exactly as a 10.000-byte executable HAPPY99.EXE file. This file has Win32 Portable Executable (PE) internal structure. The worm installs itself into the Win95/98 systems and continues spreading with no problems. Under WinNT, it is not able to spread because of bugs.
The worm contains text strings, some of them are encrypted:
Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999.
Happy New Year 1999 !!
begin 644 Happy99.exe end
Ska.exe liste.ska
wsock32.dll Ska.dll Ska.exe

When the HAPPY99.EXE file is executed, the worm copies itself to the Windows system directory with the SKA.EXE name and drops the additional SKA.DLL file in the same directory. The SKA.DLL is stored in the main EXE file (HAPPY99.EXE) in encrypted and lite-packed form.
The worm then copies the WSOCK32.DLL to the WSOCK32.SKA name (makes a "backup") and patches the WSOCK32.DLL file. If the WSOCK32.DLL is in use and cannot be opened for writing, the worm creates a new key in the system registry to run its dropper during the next rebooting:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce=SKA.EXE

The WSOCK32.DLL patch consists of a worm initialization routine and two redirected exports. The initialization routine is just a small piece of worm code - just 202 bytes. It is saved to the end of WSOCK32.DLL code section (".text" section). The WSOCK32.DLL has enough space for that, and the size of WSOCK32.DLL is not increased during infection. Then the worm patches the WSOCK32.DLL export tables so that two functions ("connect" and "send") will point to the worm initialization routine at the end of WSOCK32.DLL code section.
When a user is connecting to the Internet the WSOCK32.DLL is activated, and the worm hooks two events: connection and data sending. The worm monitors the e-mail and news ports (25 and 119 - smtp and nntp). When it detects a connection on one of these ports, it loads its SKA.DLL library that has two exports: "mail" and "news". Depending on the port number, the worm calls one of these routines, but both of them create a new message, insert UUencoded worm HAPPY99.EXE dropper into it, and send it to an Internet address. The worm also adds its stamp to the kludge header of "infected" messages:
X-Spanska: Yes

While sending infected attachments, the worm stores the recipients' addresses to the LISTE.SKA file in the Windows system directory. This "log" file contains up to 5K of data, and may contain up to about 200 addresses the infected messages were sent to.


Demonstrations of the virus' effects:

happy.gif

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Paukor

Description I-Worm.Paukor

This is a virus-worm that spreads via the Internet attached to infected e-mails. The worm itself is a Windows PE EXE file about 450Kb in length, and is written in Delphi. The worm has several components (main and additional) described below.
The infected messages have an attached FILES.EXE file (the worm itself), and have different text fields that are randomly selected by the worm from several variants (see below).
The first and last lines in the message body are:
first line in Body is randomly selected from "Hi!" or "Hello,"
the last line in Body is also randomly selected from empty line, or
"Regards,"
"Your friend,"
"Best Regards"
"Kind Regards"
and is completed with %UserEmailName% (user's display name in email messages)
The Subject and Body variants are:
Subject: Your loved one in indecent pictures :(
Body:
Hi! or Hello,
I'm sorry I have to send you these compromising pictures with the one you love, or you loved. You will know where they were taken as soon as you see them.
I' compressed it as a self extracting archive because I din't knew if you have WinZip. When you run it, it should display the extract dialog. I'm really sorry I had to be the one who told you about this.
Regards, or Your friend, or Best Regards or Kind Regards
Subject: Surprise for you!
Body:
Hi! or Hello,
I have a surprise for you. It's a electronic card made by myself :). It contains some graphics and sound and I had to compress it as self extracting archive. :))
I hope you like it, please see the attached file.
Regards, or Your friend, or Best Regards or Kind Regards
Subject: Pictures from the last party
Body:
Hi! or Hello,
Here are the pictures from the last party. Some of them are so funny! I compressed them as self extracting archive as they were too large, over 2.1 Mb! :))
I made the archive self extracting, because I din't knew if you have WinZip. When you run it, it should display the extract dialog.
Please let me know what you think. :)
Regards, or Your friend, or Best Regards or Kind Regards
Subject: No subject
Body:
Hi! or Hello,
Here are some files related to what we have talk about.
I made the archive self extracting, because I din't knew if you have WinZip. When you run it, it should display the extract dialog.
Please let me know what you think. :)
Regards, or Your friend, or Best Regards or Kind Regards
The worm is activated from an infected e-mail only when a user clicks on an attached file. The worm then installs itself to the system, drops additional components and runs a spreading routine.
Main Component
When the main worm component, FILES.EXE, is executed, the worm installs its other components in the system. These components are created in the Windows directory with the following names:
SYSTRAY.EXE - 66K of length
CWAB.EXE - 341K of length
MSP.DLL - 20K of length

All are Windows PE EXE files and are written in Delphi, as is the main worm file. The EXE files (SYSTRAY.EXE and CWAB.EXE) are executed then by the main worm component. The worm's main component then copies itself (the FILES.EXE file) to the Windows directory, displays a "decoy" message and exits. The message appears as follows:

The CWAB Component
This the worm component, that when run, spreads the worm with e-mail and sends e-mail with a keylog file to the worm host (with an e-mail address at @yahoo.com and @softhome.com).
While sending e-mails, the worm obtains a victim's e-mail addresses from the WAB (Windows Address Book) database, connects to a SMTP server, and sends infected e-mail messages.
This worm component is designed for being run only under the main FILES.EXE worm file. Being run as a stand-alone application, it simply displays the following fake message and exits:

The SYSTRAY and MSP Components
This is a "keylogger" worm component. When run, it registers itself in the registry auto-run key:
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
then activates the "key-logging" library MSP.DLL, which logs keyboard strokes to a MSP.DAT file in the Windows directory. This file is then sometimes sent to a host e-mail address.
This worm's component has the following "copyright" text strings in it:
PayK Worm
Copyright (c) 2001 by TheShadow
Disclamer: This program has been made for educational and research purposes only.

I-Worm.Peach

Description I-Worm.Peach

This internet worm spreads via e-mail messages and sends itself from infected PCs when it is activated. It uses Microsoft Outlook mailing system for sending itself to recipients, whose e-mails are stored in Outlook Address Book.
The worm is written in Visual Basic Script (VBS) programming language. It works only under operating systems with Windows Scripting Host installed (WSH is installed by default in Windows 98 and Windows 2000).
The worm uses a PDF file as a host. The virus code is included in that file as an embedded object, and the worm can be activated only manually.
When a PDF file is opened by the Adobe Acrobat program, (the worm doesn't work in Acrobat Reader), a user is offered to play a simple game, which is stored in an embedded object.
After the embedded object is activated, the Adobe Acrobat (http://www.adobe.com/acrobat) program extracts VBS code, writes it to a tempopary folder and launches it.
The virus code creates a JPG file on a disk and shows it using Internet Explorer.
Then, the worm tries to find its host PDF file on the disk, and if it finds the file, sends it to recipients specified in Outlook Address Book.
For sending itself, the worm randomly chooses an attachment name, message subject and body.
The message subject can contain the following strings:
"You have one minute to find the peach"
"Find the peach"
"Find"
"Peach"
"Joke"
The subject can also contain the "FW:" prefix and an exclamation mark at the end of it.
The message body is assembled from the following sentences:
"Try finding the peach"
"Try this"
"Interesting search"
"I don't usually send this things, butall"
The attachment name may be the following:
"find.pdf"
"peach.pdf"
"find the peach.pdf"
"find_the_peach.pdf"
"joke.pdf"
"search.pdf"
The worm uses a very complex algorithm for sending itself, sometimes resulting in the worm not sending itself at all.

Home