Malicious E-Mail Disguised as Electronic Greeting Card

All Ball State University computer users should be aware of a new and dangerous security threat which arrives via e-mail. At least one computer on campus has already been affected. The messages may take several forms but most commonly appears as an notification that someone has sent a "greeting card." The messages will most likely have no attachment, but will attempt to lull the reader to click on the link appearing in the e-mail message. An example of such as message appears below:

From: netfuncards.com
Sent: Thursday, August 09, 2007 8:19 PM
To: username@bsu.edu
Subject: Colleague sent you a greeting card from netfuncards.com!

Colleague has created an ecard for you at netfuncards.com, the Internet's most popular greeting card service.

Your greeting card ID is: b19d3383b4c009ee64d82c3a9e

To see your custom greeting card, simply click on the link below:

http:// 64.233.187.99/?b19d3383b4c009ee64d82c3a9e

Send greeting cards from netfuncards.com whenever you want by visiting us at:

http://netfuncards.com/

Although the text of the message may change, the goal of the message is to get the unsuspecting reader to click on the link. The malicious link in this example appears with numbers (64.233.187.99 is used for illustrative purposes) however the link may also appear as a name.

What You Should Do

If you receive a message such as the one above, do not click on the link contained within the message. Even if you take no other action, clicking on the link can cause your computer to become infected. Simply delete the message, or if you have reason to believe the card is legitimate, visit the vendors site by opening a web browser and typing the address of the service in manually.

If you had reason to believe the card in the above example was legitimate and wanted to check, you would open a web browser and enter http://www.netfuncards.com/ to reach the web site. Upon reaching that page, you would then enter the "code" or "Card ID" on the retrieval form which appears on that page. In the above example, the "code" is shown as b19d3383b4c009ee64d82c3a9e.

Also make certain your antivirus software is installed and up-to-date. Many attempts to attack your computer can be prevented by using antivirus software which is functional and up-to-date. Visit the Ball State University Antivirus web site at www.bsu.edu/antivirus/ for more information.

For additional information about viruses, scams, hoaxes and spam visit the Security & Policy Website.