New Frethem variety

[mjc]

New Frethem version.....


http://www.sarc.com/avcenter/venc/data/w32.frethem.j@mm.html


W32.Frethem.J@mm is a worm, and is a variant of W32.Frethem.B@mm. It uses its own SMTP engine to send itself to email addresses that it finds in the Microsoft Windows Address Book and in .dbx, .wab, .mbx, .eml, and .mdb files. The email message arrives with the following characteristics:

Subject: Re: Your password!
Attachments: Decrypt-password.exe and Password.txt

[Mark Miller]

MJC.
It just showed up on my outlook express mail.. Mcvee picked it up right away and told me not to open. Great timeing on your part.


thanks Mark

[joea64]

Thanks for the heads-up. I wouldn't open any mail with a title like that, anyway, in the first place, unless it came from somebody with whom I actually do have an account, and the attachments would make me suspicious in any case. This is why I like MailWasher so much; I can catch virus-laden emails on the server and trash them before they ever even get downloaded.

-Joe-