Frethem.J
Threat LevelDamageDistribution

Effects 

Frethem.J it has the following effect:

• It obtains the e-mail addresses stored in the Addresss Book, in an attempt to spread to other computers.

Infection strategy 

Frethem.J creates the following file:

• TASKBAR.EXE is created in the Windows directory, making it possible to create a Windows task that stays memory resident.

Frethem.J creates the following entry in the Windows Registry:

• HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Run\ Task Bar = %Windows%\ TASKBAR.EXE

  Through this entry, the worm ensures it is run on every system startup.

Means of transmission 

Frethem.A uses e-mail to spread, and it carries out the following actions:

• It arrives in an e-mail message with the following characteristics:

• Subject:

  Re: Do your Windows looks like Windows XP? I have found very nice desktop themes!

• Message:

  Hello!
  Do you like modern design of new Windows XP?! I have found FREE and easy to use desktop themes!
  You can open attach with web site and samples! Enjoy it!!!

• Attachment:

  WWW.FREEDESKTOPTHEMES.COM.

Although COM is the most common extension (in an attempt to pass itself off as a Website address), occasionally, the following extensions are also possible: EXE, BAT or CMD.

It sends itself out automatically to all the contacts found in the Address Book.