TROJ_SKA is a Win32 virus that we can actually classify as a computer worm. It only makes itself spread on computer networks, travelling through the Internet via E-Mail and Newsgroup. This worm does not destroy or infect any file. It just has the ability of self-replication. It replicates on computer networks by automatically attaching a file on E-Mail messages and Newsgroup Posting. The file that it attaches automatically is the HAPPY99.EXE. When executed, it will put up a very nice ireworks display. But as the fireworks is shown on the screen, the virus makes its move. It will modify the file WINSOCK32.DLL and by this it can monitor your system whenever you are sending E-Mails or making Newsgroup postings. Thus, when the user sends an E-Mail or made a Newsgroup postings, the virus will make a copy of the HAPPY99.EXE file and automatically attach the file on the E-Mail or Newsgroup postings without the computer user knowledge.

Upon execution of the file HAPPY99.EXE, it will put up a nice fireworks display but actually this is just a way of the virus for it not to be noticed by the computer user. But what it really does is it first creates the files SKA.EXE and SKA.DLL. SKA.EXE is just a copy of the HAPPY99.EXE file. Then the virus will make some patches in the WSOCK32.DLL that makes its exports entries for two functions now point to the virus functions itself. The original WSOCK32.DLL is saved in the system directory as WSOCK32.SKA. If ever the WSOCK32.DLL file is in use by other applications, the virus will modify the Registry RunOnce entry to execute the SKA.EXE upon the next boot-up. In this case, it can already modify the WSOCK32.DLL file before other
applications can use it. The file SKA.EXE does not display the fireworks anymore upon execution. It will just directly alter the file WSOCK32.DLL. The virus will patch a Connect and Send exports in the WSOCK32.DLL, thus it can check whether the system is making some network activity. When these two exports are called, the virus loads the SKA.DLL file, which contains two new exports, the news and mail.
Then, whenever the user sends an e-mail or makes a Newsgroup posting, the virus will convert the file SKA.EXE to UUencoded format and attaches this file in the E-mail
or Newsgroup postings as HAPPY99.EXE. You can find this text in the virus body, but it is encrypted: Is it a virus, a worm, a trojan? MOUT-MOUT Hybrid (c) Spanska 1999.