Need help? Ask the community or hire an expert.
Go to Avira Answers
Alias:W32.Frethem.K@mm, I-Worm.Frethem.l [KAV], W32/Frethem.l@MM [McAfee], WORM_FRETHEM.K [Trend], W32/Frethem-Fam [Sophos], Win32.Frethem.K [CA], W32/Frethem.K [Panda], W32/Frethem.L [F-Prot]
Size:48,640 Bytes 
Damage:Sent by email. 
VDF Version:  

DistributionThe worm searches for email addresses in Windows Address Book and files of type: .dbx .wab .mbx .eml .mdb
The email has the following structure:

Subject: Re: Your password!

Body: ATTENTION! You can access very important information by this password DO NOT SAVE password to disk use your mind now press cancel


Decrypt-password.exe is a worm copy, packed with UPX and PE, having ~48 kB. Password.txt is ~ 93 Bytes, but has no virus content.

Technical DetailsWhen activated, Worm/Frethem.010 copies itself in:

It changes the following autostart entry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Task Bar %WinDIR%\taskbar.exe

The worm receives information about SMTP server, email addresses and server name from the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\00000001\SMTP Server

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\00000001\SMTP Email Address

HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts\00000001\SMTP Display Name

The worm uses the mutex "IEXPLORE_MUTEX_AABBCCDDEEFF" which allwos only one active version of the worm on the system.

After some hours break, the worm copies itself for autostart, in:
C:\Windows\All Users\Start Menu\Programs\Startup\Setup.exe
설명 삽입자 Crony Walker   2004년 6월 15일 화요일

뒤로 . . . .
https:// 이 창은 보안을 위해 암호화되었습니다.