FriendGreeting is an e-card service that behaves similar to an email worm once installed, although it could also be seen as a PUP. Upon execution of the installer, the user will be asked to approve the associated certificate and accept the EULA. The EULA contains a clause that permits access to Outlook's notebook, which somewhat permits the subsequent worm-like spreading routine.
An email will be sent to all email addresses that can be retrieved from Outlok, with the following message.
- Subject: %recipient% you have an E-Card from %sender%.
- %sender% has sent you an E-Card — a virtual postcard from FriendGreetings.com. You can pickup your E-Card at the FriendGreetings.com by clicking on the link below.
- http:(slash)(slash)www dot friendgreetings dot com(slash)pickup(slash)pickup dot aspx?
The program will also add the following registry key:
- “PMedia”=”C:Program FilesCommon FilesMediawinsrvc.exe”
- Email-Flooder.Win32.FriendGreetings, Kaspersky Threats