1. Symantec/
  2. Security Response/
  3. W32.Frethem.K@mm


Risk Level 2: Low

July 12, 2002
February 13, 2007 11:39:37 AM
Also Known As:
I-Worm.Frethem.k [AVP], W32/Frethem.k@MM [McAfee], WORM_FRETHEM.J [Trend], W32/Frethem-Fam [Sophos], W32.Frethem.I@mm
Systems Affected:
Windows 2000, Windows 98, Windows Me, Windows NT, Windows XP
CVE References:

NOTE: Virus definitions dated prior to July 17, 2002 detect this as W32.Frethem.J@mm.

W32.Frethem.K@mm is a worm, and is a variant of W32.Frethem.B@mm. It uses its own SMTP engine to send itself to email addresses that it finds in the Microsoft Windows Address Book and in .dbx, .wab, .mbx, .eml, and .mdb files. The email message arrives with the following characteristics:

Subject: Re: Your password!
Attachments: Decrypt-password.exe and Password.txt

Removal tool
Symantec has provided a tool to remove infections of W32.Frethem@mm. Click here to obtain the tool.
This is the easiest way to remove these threats and should be tried first.

Antivirus Protection Dates

  • Initial Rapid Release version July 12, 2002
  • Latest Rapid Release version May 31, 2016 revision 036
  • Initial Daily Certified version July 12, 2002
  • Latest Daily Certified version June 1, 2016 revision 005
  • Initial Weekly Certified release date July 17, 2002
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Douglas Knowles

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube