Virus Characteristics

The worm arrives via an email attachment, NakedWife.exe. Executing this application will infect your machine and causes the worm to mail itself to all users in the address book.

This program is written in Visual Basic and requires the Visual Basic 6 (or higher) runtime files in order to execute. When run, it copies itself to a TEMP directory and displays a Window entitled, "Flash" which reads "JibJab Loading". It then starts sending a separate email message to each recipient in the Windows Address Book using Microsoft Outlook.

The suspect messages appear as follows:

Subject: Fw: Naked Wife
Body:
> My wife never look like that! ;-)

Best Regards,
(sender's name)

Attached: NakedWife.exe
File size approx. 70k

Choosing the HELP|ABOUT menu in the "Flash" window displays a message box entitled, "Flash", which reads "You're are now FUCKED! (C) 2001 by BGK (Bill Gates Killer)"


Payload

This worm poses as a Flash movie. When run, it sends itself to all recipients in the Windows Address Book and attempts to delete all .BMP, .COM, .DLL, .EXE, and .INI files in the WINDOWS and WINDOWS\SYSTEM directories.


Preventative Measures

Filter & Block NakedWife.exe


Fixes Available

Network Associates: 4127 or extra.dat
Symantec: Definitions dated March 6, 2001 or pre-certified defs
Trend: Pattern 859