W32.Frethem - Your password placed in password.txt yourpassword.exe (BGI)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W32.Frethem

Sender:

Varies. Usually someone who knows you. (A)

Subject:

Re: Do your Windows looks like Windows XP? I have found very nice
desktop themes! (AE)
Re: Your password! (BCFGHIJKLMNO)

Message:

ATTENTION! (D)
DO NOT SAVE password to disk (D)
Do you like modern design of new Windows XP?! I have found FREE and
easy to use desktop themes!You can open attach with web site and
samples! Enjoy it!!! (A)
Hello!
now press cancel (D)
use your mind (D)
You can access very important information by this password (D)

Attachment:

Decrypt-password.exe (DFHJKLMNO)
Password.txt (BCFGHIJKLMNO)
Your password placed in password.txt yourpassword.exe (BGI)
www.freedesktopthemes[plus a random number].[a random extension
chosen from com, .exe, .bat, or .cmd] (A)
www.xpdesktopthemes.com (E)

Comments: A worm which uses its own SMTP engine to send itself to addresses itfinds in the Windows Address book. Some variations search other types of filesfor addresses.

Symptoms:


 Copies itself to C:WindowsAll UsersStart
MenuProgramsStartupSetup.exe so that it is executed each time that
you start Windows.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Obtain the most recent virus defs.
Make sure NAV is set to scan all fines and do a complete system scan.
Delete all files that NAV detects as W32.Frethem.Gen@mm.
If NAV reports that it cannot delete an infected file, you must shut down the computer,turn off the power, and wait 30 seconds. Then restart the computer in Safe mode and runthe scan again.