Advert.FriendGreettings
Description Advert.FriendGreettings
Advert.FriendGreetings is an electronic post card program that once installed, unlike other similar programs, sends out emails to all addresses found in a victim computer's Microsoft address book. This obnoxious feature has lead some anti-virus companies to classify this program as a "worm".
If a user clicks on the link found in the email the installation procedure begins.
During installation the program displays a certificate of authenticity. If a user accepts the electronic signature he or she is given the chance to look over a license agreement (EULA). tIf a user either disagrees with the license agreement or doesn't trust the certificate, installation of the program terminates.
The Certificate verifying "safe content"!
When a user accepts the license agreement (below picture)the program is installed on their machine and "Advert.FriendGreetings" proceeds to send out messages to all the addresses found in their Microsoft Outlook address book.
The License Agreement
The email messages look as follows:
Subject: %recipient% you have an E-Card from %sender%.
Message:
Greetings!
%sender% has sent you an E-Card -- a virtual postcard from FriendGreetings.com. You can pickup your E-Card at the FriendGreetings.com by clicking on the link below.
http:/ /www.friendgreetings.com/pickup/pickup.aspx?
Message:
------------------------------------------------------------
%recipient%M
I sent you a greeting card. Please pick it up.
%sender%
------------------------------------------------------------
When this software installs it adds the following registry keys:
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
"PMedia"="C:Program FilesCommon FilesMediawinsrvc.exe"
Check other viruses! Be aware! Use Antiviral Software
Dashel.1804
Description Dashel.1804
It's a not memory resident dangerous parasitic virus. It searches for .EXE-files and writes itself to their ends. It searches for C:DASHEL file and if this file is present, the virus erases the disk sectors. It also erases the sectors in several other cases.
Datacrime.1168.a
Description Datacrime.1168.a
This is a very dangerous nonresident virus. As an infected file is executed, it infects by standard way not more than one COM file in all current directories of all available disks though it does not infect COMMAND.COM. Depending on the timer and its own internal counters, the virus displays the text:
DATACRIME VIRUS RELEASED: 1 MARCH 1989
After that it makes an attempt to format some tracks of the hard disk.
|