Alias:W32/Frethem
Type:Worm 
Size: 
Origin: 
Date:06-13-2002 
Damage:Spreads by email. 
VDF Version:6.19.00.00 
Danger:Low 
Distribution:Medium 

DistributionWorm/Frethem is an Internet worm that spreads by email. It collects email addresses from Windows Address Book and .dbx files. The email looks like this:

Subject: Re: Your password!

Body: ATTENTION! You can access very important information by this password DO NOT SAVE password to disk use your mind now press cancel

Attachment:
decrpyt-password.exe
password.txt

Technical DetailsWorm/Frethem has its own SMTP engine and does not need an email program as Outlook, to send itself.
The worm file is ‘Decrypt-password.exe’. The second attachment ‘password.txt’ is empty and has no payload.

The file content is:
'Your password is W8dqwq8q918213'

Worm/Frethem copies itself in Autostart folder from Windows Startmenu. so it will be activated by every system start.
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .