Trend just released their update, 371. You can also just "fix" your DNS to the friendgreetings.com to point somewhere else.
- John Q Jr. ----- Original Message ----- From: "Brian Dugas" <[EMAIL PROTECTED]> To: "Exchange Discussions" <[EMAIL PROTECTED]> Sent: Thursday, October 24, 2002 1:57 PM Subject: RE: Anyone else getting this E-card semi virus? > We are getting it too, but we have Trend Anti-SPAM software detecting it and > blocking it. > But Trend's antivirus does not see it. > > We blocked the domain on our proxy server, just in case. > > Brian > > > > -----Original Message----- > From: Durkee, Peter [mailto:DurkeeP@;LanePowell.com] > Sent: Thursday, October 24, 2002 4:55 PM > To: Exchange Discussions > Subject: RE: Anyone else getting this E-card semi virus? > > > It comes from whatever previous victim got the message and installed the > software. It doesn't show as coming from the website's domain, which is > friendgreetings.com. > > -Peter > > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:blambert@;endoxy.com] > Sent: Thursday, October 24, 2002 13:48 > To: Exchange Discussions > Subject: RE: Anyone else getting this E-card semi virus? > > > What is the from address? > > Bill Lambert > Endoxy Healthcare > 847-941-9206 > [EMAIL PROTECTED] > > > > -----Original Message----- > From: Durkee, Peter [mailto:DurkeeP@;LanePowell.com] > Sent: Thursday, October 24, 2002 3:45 PM > To: Exchange Discussions > Subject: RE: Anyone else getting this E-card semi virus? > > > We had one user install it. The good news is that it doesn't hit the GAL, > just the actual Contacts, and the user in question only had six of them. > > -Peter > > > -----Original Message----- > From: Christopher Hummert [mailto:hummertc@;noghri.net] > Sent: Thursday, October 24, 2002 13:38 > To: Exchange Discussions > Subject: RE: Anyone else getting this E-card semi virus? > > > Had about 3 of them this morning. My users don't have rights to install > software so I was able to stop it that way > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:bounce-exchange-97309@;ls.swynk.com] On Behalf Of Durkee, Peter > Sent: Thursday, October 24, 2002 1:31 PM > To: Exchange Discussions > Subject: Anyone else getting this E-card semi virus? > > > It seems to be really more of a self-replicating spam. A user gets an e-card > which directs them to a web site to see the card. The site says they need to > install software to see the card. The user installs the software which has a > EULA allowing the software to send e-cards to everyone in the user's > Contacts list. The software then proceeds to do so. > > The full story is at http://vil.nai.com/vil/content/v_99760.htm > > I've stopped about 15 of them today. If you can filter on words in the > subject line, you might want to enter the phrase, "you have an E-Card from". > > -Peter > > > ______________________________________________ > This message is private or privileged. If you are not the person for whom > this message is intended, please delete it and notify me immediately, and > please do not copy or send this message to anyone else. > > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] > > ______________________________________________ > This message is private or privileged. If you are not the person for whom > this message is intended, please delete it and notify me immediately, and > please do not copy or send this message to anyone else. > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] > > ______________________________________________ > This message is private or privileged. If you are not the person for whom > this message is intended, please delete it and notify me immediately, and > please do not copy or send this message to anyone else. > > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:leave-exchange@;ls.swynk.com > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED]
