The TROJ_Y2KCOUNT virus is distributed in a fake email from Microsoft that claims it to be a Microsoft Year 2000 Counter. Upon execution of the Y2KCOUNT.EXE file, which is attached to an email message apparently from Support@Microsoft.com, TROJ_Y2KCOUNT displays the following WINZIP error message:

"Password protection error or invalid CRC32!"

TROJ_Y2KCOUNT then drops several files to the Windows System directory, it modifies the SYSTEM.INI file, and overwrites the WSOCK32.DLL file in order to intercept password, login, and username information.

Masked as an email from Microsoft, the Y2K countdown Trojan is distributed as an attachment called Y2KCOUNT.EXE. The mail seems to be coming from Microsoft and contains the following text:

From: support@microsoft.com
Sender: support@microsoft.com
Subject: Microsoft Announcement
Date: Wed, 15 Sep 1999 00:49:57
+0200

To All Microsoft Users,

We are excited to announce Microsoft Year 2000 Counter.

Start the countdown NOW. Let us all get in the 21 Century. Let us lead the way to the future and we will get YOU there FASTER and SAFER.

Thank you, Microsoft Corporation

When the Y2KCOUNT.EXE file is executed, it displays a WINZIP self-extracting dialog box and a bogus message box containing the following text appears:

Password protection error or invalid CRC32!

The Trojan then drops the files PROCLIB.DLL, PROCLIB.EXE, PROCLIB16.DLL and SVSRV.DLL into the Windows System directory and makes changes to the SYSTEM.INI file. It overwrites WSOCK32.DLL with the contents of PROCLIB16.DLL, and keeps a copy of the original WSOCK32.DLL as a file called NLHVLD.DLL.

PROCLIB16.DLL mimics the functionality of WSOCK32.DLL and appears to search for the words "password", "login" and "username" in incoming and outgoing mail.