Aliases: Win32.HLLW.Naked, Win32/Naked.Worm , I-Worm.Naked.A

I-Worm.Naked.A is a worm written in Visual Basic.  It spreads as an email file attachment.  Its size is 73728 bytes.  The worm operates under the  Windows operating system.  To be able to successfully activate it requires the library MSVBVM60.DLL.
The worm arrives as the file Nakedwife.exe in an attachment of an email message with subject "Fw: Naked Wife". The message body is formed by the following text:

My wife never look like that! ;-)

Best Regards,
meno_infikovaného_užívatela
(Meaning: name of the infected user)

Instead of the text name of the infected user the worm uses a real name of the infected user.  After the file in the attachment of the message is executed, the following window is displayed:

If the user clicks on the menu item Help, the following window is displayed:

After displaying the first window the worm sends out its copies to all contacts found in the address book of the Microsoft Outlook.

Note: In following text a symbolic inscription %windir%. is used instead of name of the directory in which Windows operating system is installed. Naturally, this can be different with any single installation

Win32/Naked is destructive – it deletes all files with extensions .INI, .LOG, .DLL, .EXE, .COM and .BMP in directories %windir% and %windir/System.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.