Technorati
Digg
Delicious
Reddit
StumbleUpon
Facebook
Yahoo
Twitter
Faves
Newsvine
- Discovered:
- July 15, 2002
- Updated:
- February 13, 2007 11:39:38 AM
- Also Known As:
- W32.Frethem.K@mm, I-Worm.Frethem.l [KAV], W32/Frethem.l@MM [McAfee], WORM_FRETHEM.K [Trend], W32/Frethem-Fam [Sophos], Win32.Frethem.K [CA], W32/Frethem.K [Panda], W32/Frethem.L [F-Prot]
- Type:
- Worm
- Systems Affected:
- Windows 2000, Windows 98, Windows Me, Windows NT, Windows XP
- CVE References:
- CVE-2001-0154
Due to a decreased rate of submissions, Symantec Security Response has downgraded the threat level of this worm from Category 3 to Category 2 as of May 5, 2003.
NOTE: Virus definitions dated prior to July 17, 2002 detect this as W32.Frethem.K@mm.
W32.Frethem.L@mm is a worm, and is a variant of W32.Frethem.B@mm. It uses its own SMTP engine to send itself to email addresses that it finds in the Microsoft Windows Address Book and in .dbx, .wab, .mbx, .eml, and .mdb files. The email message arrives with the following characteristics:
Subject: Re: Your password!
Attachments: Decrypt-password.exe and Password.txt
Removal tool
Symantec has provided a tool to remove infections of W32.Frethem@mm. Click here to obtain the tool. This is the easiest way to remove these threats and should be tried first.
Antivirus Protection Dates
- Initial Rapid Release version July 15, 2002
- Latest Rapid Release version January 10, 2011 revision 048
- Initial Daily Certified version July 15, 2002
- Latest Daily Certified version January 11, 2011 revision 002
- Initial Weekly Certified release date July 15, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
- Wild Level: Low
- Number of Infections: More than 1000
- Number of Sites: More than 10
- Geographical Distribution: Medium
- Threat Containment: Easy
- Removal: Moderate
Damage
- Damage Level: Low
Distribution
- Distribution Level: High
Writeup By: Douglas Knowles
