McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• W32.Frethem.J@mm (Symantec)

• W32/Frethem.gen@MM (NAI)

• WORM_FRETHEM.J (TrendMicro)

Characteristics

This W32/Frethem variant has gotten some media attention due to the fact that it was accidentally sent to a well-known anti-virus mailing list (not by an anti-virus company) and most anti-virus products did not detect it at that time. McAfee products were the exception as the DAT files that were released more than three weeks prior to this mailing contained generic W32/Frethem detection, which protected its users well before the release/creation of this threat.

This W32/Frethem variant is detected as W32/Frethem.gen@MM with the 4208 DATs, or higher, when scanning compressed files with the current scan engine. Specific detection of this variant, W32/Frethem.k@MM, will be included in the 4212 weekly dat release.

This mass-mailing worm gathers email addresses from Microsoft Outlook Express mailbox files (.DBX files), the Windows Address Book (.WAB file), .MBX, .EML, and .MDB files to send itself via SMTP using the following information:

Subject: Re: Your password!
Body: ATTENTION!

You can access
very important
information by
this password

DO NOT SAVE
password to disk
use your mind

now press
cancel

Symptoms

• Presence of the file %WinDir%\Taskbar.exe
• Presence of the file %WinDir%\Winstat.ini

Method of Infection

This worm exploits an Internet Explorer vulnerability to automatically run on unpatched systems. Once run, the worm sends itself to email addresses found on the local system.

Removal

All Windows Users:
Use current engine and DAT files for detection and removal.

Manual Removal Instructions

• Restart the computer in safe mode
• Delete the following files
  • %WinDir%\Taskbar.exe
  • %WinDir%\Winstat.ini
• Delete the registry key values
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
    Run\Task Bar
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Run\Task Bar

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Aliases

• W32.Frethem.J@mm (Symantec)

• W32/Frethem.gen@MM (NAI)

• WORM_FRETHEM.J (TrendMicro)

Characteristics

Characteristics -

This W32/Frethem variant has gotten some media attention due to the fact that it was accidentally sent to a well-known anti-virus mailing list (not by an anti-virus company) and most anti-virus products did not detect it at that time. McAfee products were the exception as the DAT files that were released more than three weeks prior to this mailing contained generic W32/Frethem detection, which protected its users well before the release/creation of this threat.

This W32/Frethem variant is detected as W32/Frethem.gen@MM with the 4208 DATs, or higher, when scanning compressed files with the current scan engine. Specific detection of this variant, W32/Frethem.k@MM, will be included in the 4212 weekly dat release.

This mass-mailing worm gathers email addresses from Microsoft Outlook Express mailbox files (.DBX files), the Windows Address Book (.WAB file), .MBX, .EML, and .MDB files to send itself via SMTP using the following information:

Subject: Re: Your password!
Body: ATTENTION!

You can access
very important
information by
this password

DO NOT SAVE
password to disk
use your mind

now press
cancel

Symptoms

Symptoms -

• Presence of the file %WinDir%\Taskbar.exe
• Presence of the file %WinDir%\Winstat.ini

Method of Infection

Method of Infection -

This worm exploits an Internet Explorer vulnerability to automatically run on unpatched systems. Once run, the worm sends itself to email addresses found on the local system.

Removal -

Removal -

All Windows Users:
Use current engine and DAT files for detection and removal.

Manual Removal Instructions

• Restart the computer in safe mode
• Delete the following files
  • %WinDir%\Taskbar.exe
  • %WinDir%\Winstat.ini
• Delete the registry key values
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
    Run\Task Bar
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Run\Task Bar

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A