Masked as an email from Microsoft, the Y2K countdown Trojan is distributed as an attachment called Y2KCOUNT.EXE. The mail seems to be coming from Microsoft and contains the following text:
From: support@microsoft.com
Sender: support@microsoft.com
Subject: Microsoft Announcement
Date: Wed, 15 Sep 1999 00:49:57 +0200

To All Microsoft Users,
We are excited to announce Microsoft Year 2000 Counter.
Start the countdown NOW. Let us all get in the 21 Century. Let us lead the way to the future and we will get YOU there FASTER and SAFER.

Thank you, Microsoft Corporation

When the Y2KCOUNT.EXE file is executed, it displays a WINZIP self-extracting dialog box and a bogus message box containing the following text appears:
Password protection error or invalid CRC32!

The Trojan then drops the files PROCLIB.DLL, PROCLIB.EXE, PROCLIB16.DLL and SVSRV.DLL into the Windows System directory and makes changes to the SYSTEM.INI file. It overwrites WSOCK32.DLL with the contents of PROCLIB16.DLL, and keeps a copy of the original WSOCK32.DLL as a file called NLHVLD.DLL.

PROCLIB16.DLL mimics the functionality of WSOCK32.DLL and appears to search for the words "password", "login" and "username" in incoming and outgoing mail.