Parent class: Malware

Malicious tools are malicious programs designed to automatically create viruses, worms, or Trojans, conduct DoS attacks on remote servers, hack other computers, etc. Unlike viruses, worms, and Trojans, malware in this subclass does not present a direct threat to the computer it runs on, and the program’s malicious payload is only delivered on the direct order of the user.

Read more

Class: Email-Flooder

Email-Flooder programs are designed to flood email channels with meaningless messages. These tools are sometimes used by spammers.

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.


Technical Details

Advert.FriendGreetings is an electronic post card program that once installed, unlike other similar programs, sends out emails to all addresses found in a victim computer's Microsoft address book. This obnoxious feature has lead some anti-virus companies to classify this program as a "worm".

If a user clicks on the link found in the email the installation procedure begins.

During installation the program displays a certificate of authenticity. If a user accepts the electronic signature he or she is given the chance to look over a license agreement (EULA). tIf a user either disagrees with the license agreement or doesn't trust the certificate, installation of the program terminates.

The Certificate verifying "safe content"!

When a user accepts the license agreement (below picture)the program is installed on their machine and "Advert.FriendGreetings" proceeds to send out messages to all the addresses found in their Microsoft Outlook address book.

The License Agreement

The email messages look as follows:

Subject: %recipient% you have an E-Card from %sender%.

%sender% has sent you an E-Card -- a virtual postcard from You can pickup your E-Card at the by clicking on the link below.

http:/ /

I sent you a greeting card. Please pick it up.

When this software installs it adds the following registry keys:

"PMedia"="C:Program FilesCommon FilesMediawinsrvc.exe"

Read more

Find out the statistics of the vulnerabilities spreading in your region on

Found an inaccuracy in the description of this vulnerability? Let us know!
Kaspersky Next
Let’s go Next: redefine your business’s cybersecurity
Learn more
New Kaspersky!
Your digital life deserves complete protection!
Learn more
Confirm changes?
Your message has been sent successfully.