www.All-Yours.net: Bogus Postcard Messages

10th August 2006

All-Yours.net is a legitimate electronic greetings card web site, who's name is being misused to spread a virus/trojan horse in the form of a downloadable executable file called postcard.exe. This email is carefully constructed to give the impression that the file you are downloading is from All-Yours.net, in fact it is on a completely different site. All-Yours.net does not have anything to do with these emails, nor has the All-Yours.net site been compromised or hacked in any way.

If you receive an email like this, do not click the links. If you want to check to see if the site is genuine, copy and paste the address into your browser's address bar.

The body of the email looks something like this:

Subject: Your postcard
From: service@postcard.com

Hello , .

A Greeting Card is waiting for you at our virtual post office! You can pick up your postcard at the following web address:
.

http://www.all-yours.net/u/view.php?id=a0190313376667.

If you can't click on the web address above, you can also
visit E-Greetings at http://www.all-yours.net/
and enter your pickup code, which is: a0190313376667.

(Your postcard will be available for 60 days.).

Oh -- and if you'd like to reply with a postcard,
you can do so by visiting this web address:
http://www.all-yours.net/
(Or you can simply click the "reply to this postcard"
button beneath your postcard!)

We hope you enjoy your postcard, and if you do,
please take a moment to send a few yourself!


Regards,
1001 E-Greetings and Postcards
http:///www.all-yours.net/

In this case, the links that appear to be to www.all-yours-net are actually pointing to http://link.pl/~gabriel/postcard.exe although it is most likely that this is a hacked site and that the other content on http://link.pl/~gabriel in no way identifies the people behind this scam.

As of 10/8/06, identification of the payload is patchy. The excellent VirusTotal gives the following analysis:

The trojan payload is broadly identified as a variant of Zapchast.

If you have opened this email, then we recommend that you scan your system thoroughly with a good anti-virus program or a reputable anti-spyware application.