From owner-freebsd-isp Tue Mar 6 22:24: 7 2001 Delivered-To: freebsd-isp@freebsd.org Received: from digitaldaemon.com (digitaldaemon.com [63.105.9.34]) by hub.freebsd.org (Postfix) with SMTP id CA7BE37B71A for ; Tue, 6 Mar 2001 22:22:24 -0800 (PST) (envelope-from jan@smartsoft.cc) Received: (qmail 65576 invoked from network); 7 Mar 2001 06:16:57 -0000 Received: from unknown (HELO smartsoft.cc) (192.168.0.73) by smartsoft.cc with SMTP; 7 Mar 2001 06:16:57 -0000 Message-ID: <3AA5D28A.99318324@smartsoft.cc> Date: Wed, 07 Mar 2001 01:17:46 -0500 From: Jan Knepper Organization: Smartsoft, LLC X-Mailer: Mozilla 4.76 [en] (Windows NT 5.0; U) X-Accept-Language: en MIME-Version: 1.0 To: Ad de Bondt , Al Balmer Subject: ZDNet: Help & How-To: NakedWife worm deletes Windows files Content-Type: multipart/mixed; boundary="------------A51CEEEDA3C89085DE2A98A4" Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org This is a multi-part message in MIME format. --------------A51CEEEDA3C89085DE2A98A4 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit http://netscape.zdnet.com/zdhelp/stories/main/0,5594,2688521,00.html -- Jan Knepper Smartsoft, LLC 88 Petersburg Road Petersburg, NJ 08270 U.S.A. http://www.smartsoft.cc/ http://www.mp3.com/pianoprincess Phone : 609-628-4260 FAX : 609-628-1267 FAX : 303-845-6415 http://www.fax4free.com/ Phone : 020-873-3837 http://www.xoip.nl/ (Dutch) FAX : 020-873-3837 http://www.xoip.nl/ (Dutch) In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe --------------A51CEEEDA3C89085DE2A98A4 Content-Type: text/html; charset=iso-8859-1; name="0,5594,2688521,00.html" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline; filename="0,5594,2688521,00.html" Content-Base: "http://netscape.zdnet.com/zdhelp/stori es/main/0,5594,2688521,00.html" Content-Location: "http://netscape.zdnet.com/zdhelp/stori es/main/0,5594,2688521,00.html" = = = = = = = = = ZDNet: Help & How-To: NakedWife worm deletes Windows files= =
3D"NETSCAPE 3D""   Search  -  WebMail  -  <= A HREF=3D"http://home.netscape.com/misc/nav_redir/personalize.h tml" STYLE=3D"color:#FFFFFF;">My Netscape  - &nb= sp;Buddy Chat  - &nbs= p;Help  -  Download  
3D""
3D""
 3D"Click
3D""
   Netscape Home > Computing & Internet
3D""
3D""
=
3D""  
 3D""
= = = Contents = = =
3D"" = NakedWife worm deletes Windows files
3D""
3D"" Removal and prevention
3D""
=

3D""  
=
3D"Click

= =

3D""
= = = = =
=  
= NakedWife worm deletes Windows files
By Robert Vamosi, Help & How-To
3D""
Alias JibJab, this e-mail worm can prevent you fro= m opening applications.

March 6, 2001, revised

NakedWife is a new VBS worm that= is spreading rapidly via e-mail. NakedWife (alias JibJab) also deletes i= mportant files from your Windows and System folders. Antivirus software v= endors are receiving reports from within the United States, but it is too= early to assess how quickly NakedWife is spreading. It currently ranks a= s a 6 on the ZDNet Virus Meter.

How It Works
NakedWife arrives as an e-mail with the following:

Subject: FW: Naked Wife

Body: My wife never look like that :)
Best Regards,
(Sender)

Attached: NakedWife.exe

If the user clicks the attachment, the worm will e-mail itself to all the= addresses in the Outlook Address Book. It will also load a Flash window = that will display the following message:

Figure A: NakedWife pretends to load a Flash movie.


Source: Central Command

While the above image is on the screen, NakedWife deletes files with the = following extensions:

DLL, INI, EXE, BMP, and COM =

NakedWife will then display the following message:

You're now F#*#ED! =A9 2001 by BGK (Bill Gates Killer= )

=
= = Next = >
Removal and p= revention

3D""

 3D""
=
=  
= =
= Next = >
Removal and preve= ntion  

= = = = = Best Resources <= /TR>= =
How-To: How to turn off Windows Scriptin= g Host
=  
Help: Virus Protection Guide
 
Downloads: Free anti-virus software
 
Forum: Ask your NakedWife questions here
 
 
<= !--End ComputerShopper Component-->  
=
 
3D'Printer



=
3D"" =
= =
3D= News= letters | Updates | Re= wards | Join ZDNet |
3D"ZDNet" Fe= edback | Yo= ur Privacy | Servi= ce Terms | Adv= ertise | About Us
3D"spacer"
Help   -  Site Help Map   -  Advertise with Us   -  What's New   -  What's Cool
3D"spacer"
3D"spacer"
= = = =
= Copyright © 2001 ZD Inc. ZDNet is a registered service mark o= f ZD Inc. ZDNet Logo is a service mark of ZD Inc. =
--------------A51CEEEDA3C89085DE2A98A4-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message