Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Email-Worm:W32/NakedWife


Aliases:


Email-Worm:W32/NakedWife

Malware
Email-Worm
W32

Summary

A worm that spreads via e-mail, usually in infected executable e-mail file attachments.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Email-Worm:W32/NakedWife is an e-mail worm that spreads as an attachment called NakedWife.exe. The worm uses MS Outlook Address Book to find e-mail addresses and sends itself to these addresses with the help of MS Outlook application. NakedWife has a destructive payload.

The worm is a PE executable about 74 kb long written in Visual Basic. The most probable origin is Brazil.


Execution

When the worm is run it shows a dialog box that looks like a ShockWave Flash executable animation's dialog. The dialog looks like:

All menus in this dialog box are fake except the 'Help' menu. When a user clicks on it, the worm displays a messagebox:

It should be noted that the worm's file has an icon similar to ShockWave Flash executable animation files and can confuse many users.


Payload

After the worm sends itself it performs a destructive action.

It deletes all *.INI, *.LOG, *.DLL, *.EXE, *.COM and *.BMP files (in that order) in root Windows folder and then deletes all *.INI, *.LOG, *.DLL, *.EXE, *.COM, and *.BMP files in Windows System folder.

A system attacked by this worm becomes unusable shortly after that.


Propagation (E-mail)

After the worm shows its dialog box, it opens MS Outlook Address Book and sends itself to all addresses found there. The infected message has the worm's executable as NakedWife.exe attached. The infected message looks like that:

Subject:Fw: Naked Wife
Body:My wife never look like that! ;-)
Best Regards,  [Current User]

where [Current User]is the name of an infected computer's user.





Description Created: Analysis: Alexey Podrezov; F-Secure; March 2001



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.