Dubbed W32.Naked by most antivirus vendors, the worm is written in Visual Basic and, according to McAfee AVERT Virus Researcher Patrick Nolan, requires the Visual Basic 6 (or higher) runtime files. Noting that legitimate Visual Basic applications would install these files, Patrick indicated users could search for the file "msvbvm60.dll" to determine whether the runtime files even existed on their system.
Patrick also recommends that "If you receive an exe file, ask the sender what it is. The fact that the sender will not know it has been sent, should be enough to tip you off."
Because the virus disguises itself as a Macromedia Flash file, users may be tempted to open it. Flash is an extremely popular application that allows users to create animated movies and these movies are routinely exchanged via email. In fact, if this particular forged attachment is opened, a windows displays the message "loading" and the logo of "JibJab", an independent and reputable Flash developer. (The company has indicated they have no connection to the virus).
Clicking Help | About on the logo screen reveals the true nature of this file, delivering a message from the virus author, "You’re are now F****D! (C) 2001 by BGK (Bill Gates Killer)." Meanwhile, the worm is busily deleting .BMP, .COM, .DLL, .EXE, and .INI files from the Windows and Windows\System directories. Naked also mass-mails itself to recipients listed in the infected user's Windows address book, with the subject line " Fw: Naked Wife" and message text "My wife never look like that! ;-) Best Regards,” followed by the sender’s name. The attachment is named “NakedWife.exe.”
Macromedia sent an official statement to Antivirus.About.com, stating,
"Macromedia was recently informed of a malicious trojan horse virus which claims to be a Macromedia Flash movie, but is in fact a Visual Basic attachment which will delete important Windows system files when opened. It is unfortunate that people are capitalizing on the popularity of Macromedia Flash to entice people to open this attachment, but this file is not a Macromedia Flash movie, and was not developed by JibJab, a Macromedia Flash developer."
Indeed, JibJab is not the first company to have their reputation or identity plagiarized by a virus or a hoax. Hopefully, if this particular virus writer is apprehended, the additional fines s/he will face for trademark infringement will deter other virus creators from doing the same.
Antivirus vendors released signature updates on March 6th to take care of this newest threat. Pattern files dated prior to March 06, 2001 will be unlikely to detect this worm.