Happy99 Windows Worm

When a computer runs the infected Happy99.exe program, several things happen. First, wsock32.dll is copied to wsock32.SKA. The original wsock32.dll is then patched to send copies of the virus whenever the user sends an email or posts to a newsgroup. It then drops SKA.exe and SKA.dll to the C:/WINDOWS/SYSTEM directory. SKA.exe is the same program as happy99.exe, but without the fireworks display, and ska.dll is used to patch wsock32.dll. If for some reason the wsock32.dll file is in use, the virus modifies autoexec.bat to modify wsock32.dll on next computer boot up.

Embed