Title: FW: WARNING: TROJ_NAKEDWIFE - Trend Micro Virus Encyclopedia - Virus Alert 3/6/2001
From: Brian Landwehr [mailto:firstname.lastname@example.org]
Sent: Tuesday, March 06, 2001 5:12 PM
To: Tracy Chermack; Tom Gendreau; Todd Madson; Tim Shallbetter; Tessa
Goettl; Suzy Piepgras; Susan Landwehr; Steve Mosing; Steve Miller; Steph
Cappelleri; Shawn Mueske; Shannon Landwehr; Sara Piepgras; Roger
Landwehr; Robert Gould; Rob Batterton; Richard Landwehr; Richard Antley;
Rhonda Bartlewski; Rene Daleiden; Pete Theobald; Peggy Powers; Niki
Funk; Neil Freetly; Natalie Gendron; Mike Cummings; Melanie Hovde; Megan
Landwehr; Mary Ellen Landwehr; Mark Peterson; Lynette Wohlers; Louise
Cooper; Linda Rademacher; Linda McAnern; Lee Piechowski; Kylie Roebuck;
Kris Stears; Kerri Theobald; Kathleen Howard; Joni Wyman; Joke List
Jason Tschetter's; John Bykowski; Jody Streit; Jim Streit; Jim Kiley;
Jerry Smith; Jennifer Elliott; Jeff Nordeen; Jason Tschetter; Janna
Berkholtz; Graham Hine; Faye Levine; Eve Beeman; Ellen Kiley; Ellen
Brundige; Don Dickerson; Derek Dees; Dennis Boehme; David Head; Dave
Orwoll; Dave Mau; Dave Gherbaz; Chris Harkman; Chris Goodnight; Carrie
Mau; Carol Massey; Carl Skildum; Brian Landwehr; Brent Buchan; Bill
Carper; Andrew Rokala; Amy Olesen
Subject: WARNING: TROJ_NAKEDWIFE - Trend Micro Virus Encyclopedia -
Virus Alert 3/6/2001
Heads up. This one is for real and it's got teeth -- luckily it's not
spreading as quickly as the others. Much like many recent viruses, it
propagates via auto-forwarding emails. IT MAY APPEAR TO COME FROM ONE OF
YOUR FRIENDS. Do not open it under any cirumstances. But unlike those
nuisance viruses, this one does real damage. See also the Associated Press'
Below info is from Trend Micro's antivirus website (see bottom of email for
link to more info):
This destructive Trojan was written in Visual Basic Script and requires VB
6.0 (MSVBVM60.DLL) to be installed in the infected computer to run. Upon
execution, this Trojan deletes all DLL, INI, EXE, BMP, LOG and COM files in
the Windows and system directories. Due to this, it is impossible to reboot
an infected system.
It propagates via MS Outlook and Outlook Express, by sending out an email to
every email address listed in the infected user's address book. This email
has the subject line "FW: Naked Wife" and the attachment "NakedWife.EXE."
(When the application is run), this Trojan deletes files with the following
file extensions in the Windows and System directories: DLL, INI, EXE, BMP,
LOG and COM
This deletion of files makes it impossible to reboot an infected computer.
This Trojan propagates via Microsoft Outlook and Outlook Express. It sends
itself out as an email attachment to all lists in the address book of the
infected user. A sample of the email is as follows:
Subject: FW: Naked Wife
Message Body: > My wife never look like that :)
After sending out the email, the Trojan displays a message box titled
"Flash," with the following text:
You're now FUCKED! (C) 2001 by BGK (Bill Gates Killer)
> -----Original Message-----
> From: Lundberg, Susan M.
> Sent: Tuesday, March 06, 2001 2:46 PM
> To: Landwehr, Brian; Tatarek, Dale C.; Hegge, Warren R.; Harkrader, Alan
> Subject: TROJ_NAKEDWIFE - Trend Micro Virus Encyclopedia - Virus Alert
> Brian, If you don't know already.
> As per our conversation with the last virus that was sent out, I have
> forwarded new virus information on to the individuals you had suggested.
> The below link will take you to Trend Micro's site that tells about a
> that is spreading wildly through Europe today. I was notified by my
> (email admin at Carlson) who heard from reliable source in Europe that
> appeared this morning. Carlson hasn't seen any of the messages appear,
> I thought I would put it out as a forewarning for Norstan. Maybe we can
> update our protection so as to avoid destruction on our end.