W32/Frethem.K Worm

 Information about the W32/Frethem.K worm:

W32/Frethem.K is an email worm. This worm will infect Windows systems. It spreads using the email addresses present in Microsoft Windows address book. It also spreads using email addresses present in DBX, MBX, EML and MDB files.

It arrives with the following subject:

Re: Your password!

The body of the mail contains:

ATTENTION!

You can access
very important
information by
this password

DO NOT SAVE
password to disk
use your mind

now press
cancel


This mail contains attachment decrypt-password.exe and Password.txt.

Upon execution of infected attachment, the worm copies itself to Windows folder as taskbar.exe to load itself at next startup. This is accomplished by making modifications to following registry key.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

After this, the worm propagates by sending emails. The worm has its own SMTP engine to send worm infected mails.

This worm first appeared on 12th July 2002.

 Other names of W32/Frethem.K worm:

This worm is also known as W32/Frethem.J, Decrypt-password.

 Removing W32/Frethem.K worm from your computer:

You can remove this worm from your computer by using Protector Plus antivirus software.