Virus Alert About the "Frethem" Virus (326353)

MORE INFORMATION

The Frethem virus arrives in an e-mail message with the following subject line: The e-mail message has two attachments:

• Decrypt-password.exe
• Password.txt

The .exe file contains the viral payload. The virus uses a previously announced vulnerability to run the virus when you read or preview the message that contains the virus.

Prevention

1. Block potentially damaging attachment types at your Internet mail gateways.
2. This virus uses a previously announced vulnerability as part of its infection method. Because of this, you must make sure that your computers are patched for the vulnerability that is identified in Microsoft Security Bulletin MS01-020. For more information about this bulletin, visit the following Microsoft Web site:

   http://www.microsoft.com/technet/security/bulletin/MS01-020.mspx

   To obtain the most recent cumulative security patch for Microsoft Internet Explorer, which includes the fixes for the vulnerabilities that were announced in Microsoft Security Bulletin MS01-020, visit the following Microsoft Web site:

   http://www.microsoft.com/technet/security/bulletin/MS02-023.mspx

3. If you are using Microsoft Outlook 2000 Service Release 1 (SR-1) or earlier, install the Outlook E-mail Security Update patch to prevent this virus (and the majority of other viruses that are borne by e-mail messages) from running.
   
   Outlook 2000 Service Pack 2 (SP2) and Microsoft Outlook 2002 automatically contain the functionality that is contained in the Outlook E-mail Security Update patch.
   
   To install the Outlook E-mail Security Update patch for Outlook 2000 SR-1 or earlier, visit the following Microsoft Web site:

   http://www.microsoft.com/downloads/details.aspx?FamilyID=96DF48A9-7638-429E-816E-35F16F6528CA&displaylang=EN

4. You can also configure Microsoft Outlook Express 6 to block access to potentially damaging attachments.For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

   291387 OLEXP: Using Virus Protection Features in Outlook Express 6

   Earlier versions of Outlook Express do not contain attachment-blocking functionality. Use caution when you open unsolicited e-mail messages with attachments.
   
   
5. Using a program-level firewall can protect you from being infected with this virus through Web-based e-mail programs.

Recovery

If your computer has been infected with this virus, contact Microsoft Product Support Services or your preferred antivirus vendor for help with removing the virus. For information about contacting Microsoft Product Support Services, visit the following Microsoft Web site: