# MA-045.072002: MyCERT Advisory - W32.Frethem.K@MM Worm

**Date:** 16 Jul 2002  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-045.072002  
**Advisory ID:** MA-045.072002

---

1.0 Description
#### 1.1 Overview
The Frethem@MM worm has 12 variants with different characteristics known so far as (A-L). The K variant of the worm was discovered on 12th July 2002 EST time and became wildspread. The earlier variants were discovered in early June. The worm uses both an IFRAME exploit and a MIME exploit, which allow the virus to be executed when you read or even preview the file.
MyCERT has received reports from a few organisations badly affected by this W32.Frethem.K@MM variant which is spreading wildly.
The risk assessment by many anti-virus vendors, for this variant has been graded to a MEDIUM risk degree.
#### 1.2 Systems Affected
Microsoft Outlook, Outlook Express, Microsoft Internet Explorer 5.01 and Microsoft Internet Explorer 5.5 without SP2
#### 1.3 Limitation
No limitations. It does not require the email receiver to open the attachment for it to execute.
#### 1.4 Aliases
W32.Frethem.K@mm
W32/Frethem.k@MM
I-worm.Frethem.K
#### 1.5 Payload
1.5.1 Sending emails out to large number of people. This is usually done by collecting email addresses from the Windows Address Book and files with \*.dbx, .wab, .mbx, .eml, and .mdb files.extensions and uses its own SMTP engine to send out infected emails.
1.5.2 The worm uses the victim's account information, ie smtp server, email address so by this way the infected email will look like it was sent by the victim.
### 2.0 Technical Matters (As extracted from Symantec)
When this worm is executed, it drops the decrypt-passward.exe and password.txt in the tmp folder and does the following:
1. It copies itself to the file %windir%\Taskbar.exe
NOTE: %windir% is a variable. The worm locates the Windows main installation folder (by default this is C:\Windows or C:\Winnt) and copies itself to that location.
2. It then configures itself to start when you start Windows by adding the value:
Task Bar %windir%\taskbar.exe
to the registry key:
HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Run
3. Next, the worm obtains the computer user's SMTP server, email address, and SMTP server name from the following registry entries:
HKEY\_CURRENT\_USER\Software\Microsoft\Internet Account Manager\Accounts\00000001\SMTP Server
HKEY\_CURRENT\_USER\Software\Microsoft\Internet Account Manager\Accounts\00000001\SMTP Email Address
HKEY\_CURRENT\_USER\Software\Microsoft\Internet Account Manager\Accounts\00000001\SMTP Display Name
4. The worm then obtains email addresses from the Microsoft Windows Address Book and from .dbx, .wab, .mbx, .eml, and .mdb files, and sends itself to those addresses. The email message has the following characteristics:
Subject: Re: Your password!
Message:
ATTENTION!
You can access
very important
information by
this password
DO NOT SAVE
password to disk
use your mind
now press
cancel
Attachments:
Decrypt-password.exe
Password.txt
Note: The Decrypt-password.exe attachment is a copy of the worm. It is packed with UPX and PE-Pack, and its size is approximately 48 KB. The second attachment, Password.txt, is a text file that is approximately 93 bytes in length. Password.txt is not viral by itself. As such, it is not detected by antivirus products. However, if the computer was infected by W32.Frethem.K@mm worm, you should delete the file manually.
5. The worm creates the "IEXPLORE\_MUTEX\_AABBCCDDEEFF" mutex. This mutex allows only one instance of the worm to execute in memory.
6. After sleeping for several hours, the worm copies itself to C:\Windows\All Users\Start Menu\Programs\Startup\Setup.exe so that it is executed each time you start Windows.
### 3.0 Possible Steps
#### 3.1 Prevention
3.1.1 Remove or turn off any unneeded services. If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
3.1.2 Ensure up-to-date patches are installed (using MS01-020 to prevent emails from being able to automatically launch executable attachments), especially on computers that host public services such as HTTP, FTP, mail, and DNS services. Information and a patch for the vulnerability can be found at:
- http://www.microsoft.com/technet/security/bulletin/MS01-020.asp
3.1.3 Block or remove email on mail server that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, and .src files.
3.1.4 Isolate infected computers quickly to prevent further compromises and restore relevant data from trusted media.
3.1.5 Do not to open attachments unless the attachment has been scanned for virus or malicious codes.
3.1.6 Do not execute software that is downloaded from the Internet unless it has been scanned for viruses or downloaded from trusted sources.
3.1.7 Upgrade to Internet Explorer 6
3.1.8 Practise safe email practices, pls refer at:
- [https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
#### 3.2 Detection
Any antivirus with the latest virus definitions is able to detect the worm.To detect the virus, run an antivirus scan with the latest signature file on your system. Ensure the anti-virus is configured to scan ALL FILES.
Note: Users can use HouseCall, Trend Micro's free online virus scanner (http://housecall.antivirus.com/).
#### 3.3 Removal
The only way to cleanup the infected PC is to to remove files detected as W32.Frethem.K@mm manually.
**3.3.1 Manual Removal:**
Remove manually all the infected files
3.3.1.1 Isolate the infected machine by disconnecting the machine from the network.
3.3.1.2 Run an anti-virus to detect the presence of the worm. Ensure the anti-virus is updated with latest virus definitions.
3.3.1.3 Look for decrypt-password.exe and password.txt in the tmp folder and delete these files.
3.3.1.4. Delete the value at registry
1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:
HKEY\_CURRENT\_USER\Software\Microsoft\Windows\CurrentVersion\Run
4. In the right pane, delete the following value:
Task Bar
5. Click Registry, and click Exit.
3.3.1.5 Restart the computer.
3.3.1.6 Re-scan the machine to make sure the machine has been cleaned completely. If there are still infected files, delete them. Please make sure you write down the filename before deleting if you want to reinstall the file later.
3.3.1.7 Re-connect the machine to the network
3.3.1.8 Take preventive measures against such worms as detailed in section 3.1 of this advisory.
### 4.0 More Information
More information on this virus can be obtained from the following sites:
4.1 **Mcafee:**
http://vil.nai.com/vil/content/v\_99565.htm
4.2 **TrendMicro:**
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM\_FRETHEM.K
4.3 **Symantec:**
http://securityresponse.symantec.com/avcenter/venc/data/[[email protected]](/cdn-cgi/l/email-protection)
4.4 **F-secure:**
http://www.f-secure.com/v-descs/frethem.shtml