When being executed, the program also opens a window entitled "Happy New Year 1999
!!" showing a firework display to disguise its other actions. The program copies
itself as SCALENE and extracts a DLL that it carries as SKA.DLL into WINDOWS\SYSTEM
directory. It also modifies WSOCK32.DLL in WINDOWS\SYSTEM directory and copies the
original WSOCK32.DLL into WSOCK32.SKA.
WSOCK32.DLL handles internet-connectivity in Windows 95 and 98. The modification to
WSOCK32.DLL allows the worm routine to be triggered when a connect or send activity is
detected. When such online activity occurs, the modified code loads the worm's SKA.DLL.
This SKA.DLL creates a new email or a new article with UUENCODED HAPPY99.EXE
inserted into the email or article. It then sends this email or posts this article.
If WSOCK32.DLL is in use when the worm tries to modify it (i.e. a user is online), the
worm adds a registry entry:
The registry entry loads the worm the next time Windows start.
Removing the worm manually:
- delete WINDOWS\SYSTEM\SKA.EXE
- delete WINDOWS\SYSTEM\SKA.DLL
- in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK
- in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL
- delete the downloaded file, usually named HAPPY99.EXE
Windows prevents you to do step #3 and #4 above if the machine is still connected to
the Internet. The file "windows\system\wsock32.dll" is used whenever the machine
is connected to Internet (i.e. through dial-up or LAN connection).
If you are using dial-up connection (i.e. America Online), you need to do the
terminate internet connection
in WINDOWS\SYSTEM\ directory, rename WSOCK32.DLL to WSOCK32.BAK in WINDOWS\SYSTEM\ directory, rename WSOCK32.SKA to WSOCK32.DLL delete the downloaded file, usually named HAPPY99.EXE
If you are connected to Internet through LAN (i.e. in the office or cable modem), you
need to do the following:
- From the Start menu, select shutdown-restart in MS DOS mode
- type CD \windows\system when DOS prompt (C:\)appears
- type RENAME WSOCK32.DLL WSOCK32.BAK
- type RENAME WSOCK32.SKA WSOCK32.DLL
- type DEL SKA.EXE
- type DEL SKA.DLL
That's It, you are now clear. Happy 99 was just one of thousands of pesky
virii which will try to infect your computer every day, as we get more
aware of them, the perpetrators become cleverer and mask their goods more
cleverly. The one tool I have found invaluable over the years is this.
We have recently become an affiliate as so many people ask what we use as
company protection. It is very reasonably priced wherever in the world you
are (this seems to make a difference!) and updates are available on an
almost daily basis, which if you set to download automatically will keep you
up to date with latest virus treats.
I have used others and must say that for overall user friendliness, cost
effectiveness and the fact that it works - it is the best by far.