I received this helpful e-mail from our AntiVirus agent last week. No machines have been hit yet. I will post it here in the hopes that it answers some questions.
Steve ---- BEGIN PASTE There is a new spam hoax being sent around the internet provided by the following company: Permissioned Media Inc., based in Panama. The e-mail will appear in your inbox and will ask you to click upon a link to view the greeting card you have been sent. The link is not necessarily related to a greeting card site, and after clicking on it, the website will state that software needs to be installed on your machine for you to view the greeting card. The terms and conditions of the license states that by agreeing to the installation of the software, you are also agreeing that a copy of the greeting card e-mail can be sent to everyone in your address book. If you accept the terms of the agreement, the executable will send a copy of the e-mail to the contacts in your Outlook Address Book. Saying no to the agreement will prevent the mass mailing of the hyperlink to the recipients listed in the Outlook Address Book. The following domains have been linked to this new hoax: www.cool-downloads.com www.cool-downloads.net www.friend-greetings.com www.friend-greeting.com www.friend-greetings.net www.friend-greeting.net www.friend-cards.net There is no attachment included in the message sent out but rather a link that must be agreed to to install the executable that will mail out an invitation to addresse 's in the Outlook Address Book. The actual program is not a worm or virus, but rather a scam to promote the company that created the spammer. The Subject of the message is as follows: Subject: %Recipient% you have an E-Card from %Sender%. Body: %Recipient%, %sender% has sent you an greeting card -- a postcard from Friend-Greetings.com. You can pickup your greeting card at Friend-Greetings.com by clicking on the link below. http://www.friend-greeting.xxxx/%number%/pickup.html?code=%name%&id=%number% < Modified for non execution > A content filter can be set using the following: * greeting card from * This will block the message from coming into an environment. Since there is no attachment related to the message virus detection will not be able to detect any executable on the message to remove its functionality. The executable is placed on desktop system by visiting the link provided in the message and agreeing to the license agreement. Sybari Software will continue to monitor the situation. We are providing this information due to concerns posed by several inquiries to support. Thank You, Sybari Software, Inc. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED]
