Malware type: Worm

Aliases: Email-Worm.Win32.Frethem.j (Kaspersky), W32/Frethem.h@MM (McAfee), W32.Frethem.H@mm (Symantec), Worm/Frethem.002 (Avira), W32/Frethem-H (Sophos),

In the wild: No

Destructive: No

Language: English

Platform: Windows

Encrypted: No

Description: 
This memory-resident, mass-mailing worm drops files and creates an autorun entry in the registry. It propagates by sending copies of itself as an attachment in email messages with the following details:

Subject: Re: Your password!
Message body: You can access
very important
information by
this password
DO NOT SAVE
password to disk
use your mind
now press
cancel
Attachments: DECRYPT-PASSWORD.EXE
PASSWORD.TXT

On systems with unpatched Internet Explorer 5.01 and 5.5, the executable file attachment, DECRYPT_PASSWORD.EXE, automatically executes when this email message is previewed or opened in Microsoft Outlook or Outlook Express.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jul. 12, 2002 6:05:56 PM GMT -0800
Description updated: Jul. 12, 2002 10:24:00 PM GMT -0800

Search a new malware

Tell us how we did. Take our quick survey.