Tue, 9 Mar 1999 20:59:27 -0000 - Message No. 5186
From: "Rainer Zweipfennig"

Subject: VIRUS !!!!!!!!!!!!!!!


This is a multi-part message in MIME format.

------=_NextPart_000_00AD_01BE6A6F.B869AD00
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

All,
short explanation:
Happy99.exe is making a emty copy of any email you send attaching itself =
to it.
Opening the attachement you make it malicious.

here a more detailed description:

http://www.datafellows.com/news/pr/eng/19990129.htm

NAME:  Win32/Ska.A=20
ALIAS:  Happy99, WSOCK32.SKA, SKA.EXE, I-Worm.Happy,
PE_SKA=20
SIZE:  10000=20
Win32/Ska.A is a Win32-based e-mail and newsgroup worm. It displays
fireworks when executed first time as Happy99.exe. (Normally this file
arrives as an e-mail attachment to a particular PC, or it is downloaded =
from
a newsgroup.)=20
When executed first time, it creates SKA.EXE and SKA.DLL in the system
directory. SKA.EXE is a copy of HAPPY99.EXE. SKA.DLL is packed inside
SKA.EXE. After this Ska creates a copy of WSOCK32.DLL as WSOCK32.SKA in =
the
system directory. Then it tries to patch WSOCK32.DLL so that its export
entries for two functions will point to new routines (to the worm's own
functions) inside the patched WSOCK32.DLL. If WSOCK32.DLL is in use, =
Ska.A
modifies the registry's RunOnce entry to execute SKA.EXE during next
boot-up. (When executed as SKA.EXE it does not display the firework, =
just
tries to patch WSCOK32.DLL until it is not used.)=20
"Connect" and "Send" exports are patched in WSOCK32.DLL. Thus the worm =
is
able to see if the local user has any activity on network. When =
"Connect" or
"Send" APIs are called, Ska loads its SKA.DLL containing two exports: =
"news"
and "mail".=20
Then it spams itself to the same newsgroups or same e-mail addresses =
where
the user was posting or mailing to. It maps SKA.EXE to memory and =
converts
it to uuencoded format and mails an additional e-mail or newsgroup post =
with
the same header information as the original message but containing no =
text
but just an attachment called Happy99.exe.=20
Therefore Happy99 is not limited like the Win32/Parvo virus which is =
unable
to use a particular news server when the user does not have access to =
it.
The worm also maintains a list of addresses it has posted a copy of =
itself.
This is stored in a file called LISTE.SKA. (The number of entries are
limited in this file.)=20
The worm contains the following encrytped text which is not displayed:=20
        Is it a virus, a worm, a trojan?=20
        MOUT-MOUT Hybrid (c) Spanska 1999.=20
The mail header of the manipulated mails will contain a new field called
"X-Spanska: YES". Normally this header field is not visible to receivers =
of
the message.=20
Since the worm does not check WSOCK32.DLL's attribute, it can not patch =
it
if it is set to read only.=20
Please note that after disinfection of this worm you will have to rename
WSOCK32.SKA back to WSOCK32.DLL in \WINDOWS\SYSTEM folder to restore all
original WinSock capabilities.=20
[Analysis: Peter Szor, Data Fellows]=20

Best regards Rainer


PS Meanwhile my Virusscanner has been updated and the virus been removed =
suggesfully. I was happy - oops what a word under these circumstances - =
that at least some of you keep cool minded even eye to eye with a virus. =
The other people who do not feel comfortable with this explanation, be =
encouraged to scratch my postings before reading.



------=_NextPart_000_00AD_01BE6A6F.B869AD00
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable









All,
short = explanation:
Happy99.exe is making a emty copy of = any email you=20 send attaching itself to it.
Opening the attachement you make it=20 malicious.
 
here a more detailed = description:
 
http://www.d= atafellows.com/news/pr/eng/19990129.htm

NAME:=20 <info/name.htm> Win32/Ska.A
ALIAS: <info/alias.htm> = Happy99,=20 WSOCK32.SKA, SKA.EXE, I-Worm.Happy,
PE_SKA
SIZE: = <info/size.htm>=20 10000
Win32/Ska.A is a Win32-based e-mail and newsgroup worm. It=20 displays
fireworks when executed first time as Happy99.exe. (Normally = this=20 file
arrives as an e-mail attachment to a particular PC, or it is = downloaded=20 from
a newsgroup.)
When executed first time, it creates SKA.EXE = and=20 SKA.DLL in the system
directory. SKA.EXE is a copy of HAPPY99.EXE. = SKA.DLL is=20 packed inside
SKA.EXE. After this Ska creates a copy of WSOCK32.DLL = as=20 WSOCK32.SKA in the
system directory. Then it tries to patch = WSOCK32.DLL so=20 that its export
entries for two functions will point to new routines = (to the=20 worm's own
functions) inside the patched WSOCK32.DLL. If WSOCK32.DLL = is in=20 use, Ska.A
modifies the registry's RunOnce entry to execute SKA.EXE = during=20 next
boot-up. (When executed as SKA.EXE it does not display the = firework,=20 just
tries to patch WSCOK32.DLL until it is not used.)=20
"Connect" and "Send" exports are patched in = WSOCK32.DLL.=20 Thus the worm is
able to see if the local user has any activity on = network.=20 When "Connect" or
"Send" APIs are called, Ska = loads its=20 SKA.DLL containing two exports: "news"
and = "mail".=20
Then it spams itself to the same newsgroups or same e-mail addresses = where
the user was posting or mailing to. It maps SKA.EXE to memory = and=20 converts
it to uuencoded format and mails an additional e-mail or = newsgroup=20 post with
the same header information as the original message but = containing=20 no text
but just an attachment called Happy99.exe.
Therefore = Happy99 is=20 not limited like the Win32/Parvo virus which is unable
to use a = particular=20 news server when the user does not have access to it.
The worm also = maintains=20 a list of addresses it has posted a copy of itself.
This is stored in = a file=20 called LISTE.SKA. (The number of entries are
limited in this file.) =
The=20 worm contains the following encrytped text which is not displayed:=20
        Is it a virus, a worm, a = trojan?=20
        MOUT-MOUT Hybrid (c) = Spanska=20 1999.
The mail header of the manipulated mails will contain a new = field=20 called
"X-Spanska: YES". Normally this header field is not = visible=20 to receivers of
the message.
Since the worm does not check = WSOCK32.DLL's=20 attribute, it can not patch it
if it is set to read only.
Please = note=20 that after disinfection of this worm you will have to = rename
WSOCK32.SKA back=20 to WSOCK32.DLL in \WINDOWS\SYSTEM folder to restore all
original = WinSock=20 capabilities.
[Analysis: Peter Szor, Data Fellows]
 
Best regards Rainer
 
PS Meanwhile my Virusscanner has been = updated and=20 the virus been removed suggesfully. I was happy - oops what a word under = these=20 circumstances - that at least some of you keep cool minded even eye to = eye with=20 a virus. The other people who do not feel comfortable with this = explanation, be=20 encouraged to scratch my postings before reading.
 
 
------=_NextPart_000_00AD_01BE6A6F.B869AD00--



www@atic.org