Friend-Greeting Worm

 Information about the Friend-Greeting worm:

Friend-Greeting is a mass mailing email worm, associated with a greeting application. This worm spreads under Windows systems. The worm mails invitation email to all addresses found in Microsoft Outlook contact list.

The worm arrives with the following subject;

<Recipient> you have an E-Card from <Sender>

<Recipient> will be picked up by the worm from the Outlook Address book.

The body of the mail contains the following message:

<Sender> has sent you an E-Card -- a virtual postcard from FriendGreetings.com. You can pickup your E-Card at the FriendGreetings.com by clicking on the link below.

http://<Worm Website>/pickup/pickup.aspx?code=<sender>&id=<id number>

Message:
-------------------------------------------------------------------------------
<Recipient>, I sent you a greeting card. Please pick it up.

<Sender>
-------------------------------------------------------------------------------

Once the user clicks on the website link, a security warning box will be displayed to accept the worm's installation. If the user selects YES then an application installer will be downloaded from the <Worm Website> and automatically executes the downloaded file.

It displays a License Agreement screen, on choosing I AGREE option, the worm displays another License Agreement screen. The contents of second License Agreement carries user's permission to access MS Outlook contact list to send mails. On choosing I AGREE option, it mails an invitation mail to all contacts.

Later on the worm displays an installer screen with a progress bar and starts downloading all the components from the website. The worm directly downloads greeting application related files to the chosen folder of the user's system.

During the above installation process, the worm tries to disable the Windows Taskbar.

This worm first appeared on 8th November 2002.

 Other names of Friend-Greeting worm:

This worm is also known as WORM_FRIENDGRT.B, EML/Greeting-Card.E