Virus Database

Mface.1441

Description Mface.1441

It is not a dangerous memory resident parasitic virus. It hooks INT 8, 13h, 21h and writes itself to the end of .COM files that are executed. Sometimes it launches several faces (01h ASCII) that are running on the screen.

Check other viruses! Be aware! Use Antiviral Software

I-Worm.Happy

Description I-Worm.Happy

This is the first known modern Internet Worm discovered "in the wild." This computer worm is a kind of virus program that, while spreading its copies, does not infect disk files as the main target, but replicates its copies by sending itself via the Internet as an attachment in e-mail messages. The worm was posted by somebody (maybe by the worm's author) to several news servers in January 1999, and then in few days, it was discovered "in the wild" in Europe and continued spreading.
The worm arrives as an attachment in an e-mail as a HAPPY99.EXE file. When an infected attachment is executed and gains control, the worm displays a funny firework in the program's window to hide its malicious nature. During this, it installs itself in the system, hooks sendings to the Internet, converts its code to the attachment and appends it to the messages. As a result the worm, when it is installed into the system, is able to spread its copies to all the addresses the messages are sent to.
While installing, the worm affects files in the Windows system directory only. It creates the SKA.EXE and SKA.DLL files in there, copies the WSOCK32.DLL to the newly created WSOCK32.SKA and patches the original WSOCK32.DLL file to hook e-mail sending calls.
Removal and Protection
If the worm is detected in your system, you can easily get rid of it just by deleting the SKA.EXE and SKA.DLL files in the system Windows directory. You also should delete the WSOCK32.DLL file and replace it with the WSOCK32.SKA original file. The original HAPPY99.EXE file should also be located and deleted.
To protect your computer from re-infection, you need only set the "Read-Only" attribute for the WSOCK32.DLL file. The worm does not pay attention to the Read-Only mode, and fails to patch the file. This trick was discovered by Peter Szor at DataFellows (http://www.datafellows.com).
Please Remember
Do not open and do not execute the HAPPY99.EXE file that you have received as an attachment in any message if you receive it from an untrusted or unknown source. You should also remember that the files you have accessed from the Internet can contain malicious code that may infect your computer, destroy data, send confidential files to through the Internet, or install spy programs to monitor your computer from a remote host.
Opening MS Office files with disabled VirusProtection and executing untrusted executable files is extremely risky. You should keep this in mind each time you see an attachment to incoming message.
Technical The worm arrives exactly as a 10.000-byte executable HAPPY99.EXE file. This file has Win32 Portable Executable (PE) internal structure. The worm installs itself into the Win95/98 systems and continues spreading with no problems. Under WinNT, it is not able to spread because of bugs.
The worm contains text strings, some of them are encrypted:
Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999.
Happy New Year 1999 !!
begin 644 Happy99.exe end
Ska.exe liste.ska
wsock32.dll Ska.dll Ska.exe

When the HAPPY99.EXE file is executed, the worm copies itself to the Windows system directory with the SKA.EXE name and drops the additional SKA.DLL file in the same directory. The SKA.DLL is stored in the main EXE file (HAPPY99.EXE) in encrypted and lite-packed form.
The worm then copies the WSOCK32.DLL to the WSOCK32.SKA name (makes a "backup") and patches the WSOCK32.DLL file. If the WSOCK32.DLL is in use and cannot be opened for writing, the worm creates a new key in the system registry to run its dropper during the next rebooting:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce=SKA.EXE

The WSOCK32.DLL patch consists of a worm initialization routine and two redirected exports. The initialization routine is just a small piece of worm code - just 202 bytes. It is saved to the end of WSOCK32.DLL code section (".text" section). The WSOCK32.DLL has enough space for that, and the size of WSOCK32.DLL is not increased during infection. Then the worm patches the WSOCK32.DLL export tables so that two functions ("connect" and "send") will point to the worm initialization routine at the end of WSOCK32.DLL code section.
When a user is connecting to the Internet the WSOCK32.DLL is activated, and the worm hooks two events: connection and data sending. The worm monitors the e-mail and news ports (25 and 119 - smtp and nntp). When it detects a connection on one of these ports, it loads its SKA.DLL library that has two exports: "mail" and "news". Depending on the port number, the worm calls one of these routines, but both of them create a new message, insert UUencoded worm HAPPY99.EXE dropper into it, and send it to an Internet address. The worm also adds its stamp to the kludge header of "infected" messages:
X-Spanska: Yes

While sending infected attachments, the worm stores the recipients' addresses to the LISTE.SKA file in the Windows system directory. This "log" file contains up to 5K of data, and may contain up to about 200 addresses the infected messages were sent to.


Demonstrations of the virus' effects:

happy.gif

I-Worm.HappyTime

Description I-Worm.HappyTime

This Internet worm spreads in e-mail messages using MS Outlook Express as well as MSMAPI service. The worm is written in Visual Basic Script language (VBS).
The worm arrives to a computer as an e-mail message in HTML format or as plain text message with an attached HTML file. In the first case, the script code in the HTML message body automatically executes upon message opening, and the worm gains control. In the other case, a user must open the attached HTML file (double-click on it) to activate the worm.
Being activated, the worm doesn't start immediately spreading; but rather begins infecting a computer.
It modifies the desktop wallpaper with an HTML file that contains the worm code inside. If the desktop has had a background picture before infection, this picture will be shown as the background of the infected HTML and in most cases, it will not be apparent to the user that the wallpaper has been changed; thus, the worm gains control each time the desktop is displayed (for example, upon Window startup) or refreshed.
Additionally, the worm infects all .HTT files in the "WEB" subfolder of the Windows folder. Windows uses these files to customize some folders in view in Explorer when the Web mode is enabled (for example, the Program Files folder). Infection of these files causes the execution of the worm code each time a specific folder is displayed.
Each time the worm gains control, it searches for files with the extensions HTM, HTML, ASP, and VBS and infects them (insert own code into these files) - one file at a time. After some time, all these files on a computer are infected.
The worm also modifies the MS Outlook Express registry values to force Outlook Express created messages in HTML format and uses stationery for this. In this way, the worm spreads in messages created using Outlook Express. Each time Outlook Express composes a new message, it uses one of the stationery templates (just HTML files, infected by the worm - see above); so the worm's script automatically enters a message.
Upon each run, the worm increments a counter in the system registry, and when it reaches value 366, the worm runs one of two spreading routines.
The first routine collects e-mail addresses from the MS Outlook address book and sends infected messages to all collected addresses.
The second routine enumerates all messages in the Inbox folder, and upon each found message, creates and sends "reply", were the subject is "Fw: " and the subject of the original message.
Both routines use MSMAPI service for sending messages.
An infected message has no text, but has the attached file "Untitled.htm" containing the worm code inside.
If the sum of the day and month is 13, the worm searches for EXE and DLL files and deletes them one file at a time.

Home