Virus Alert: "Hallmark" E-cards

Bryan Belrad
This is an email I received this morning (links disabled).

* * * * *
Subject: Ana sent you an E-card
From: "HALLMARK ECARD"
Date: Mon, March 24, 2008 5:19 am
Priority: Normal
Options: View Full Header | View Printable Version | Download this as a file | View as plain text

Hello!

You have received a Hallmark E-Card.

To see it, click here,

There's something special about that E-Card feeling. We invite you to make a friend's day and send one.

Hope to see you soon,
Your friends at Hallmark
* * * * *

While the "send one" link does go to Hallmark (in this case), the "see it" link actually goes to a .exe file on an unrelated website. This is an adaptation of a well-known scheme where false links are implanted in a real-looking email. When the link is clicked, whatever program is on the other end is installed.

Prevention:

It is impossible to verify that an email is legitimate by looking at the sender's email address alone. As you can see in the sample above, this message's sender masked his or her own email, and replaced it with a Hallmark.com ID.

There are numerous other tricks scammers can use to convince you that a fake email is real. The only way to be sure is to pay attention to what you're clicking. If you hover your cursor over a link, the destination web address will display on your screen, in many cases in the bottom of your browser window. If that website does not exactly match the sender's, the email is almost definitely malicious.

Some false links will take you to a 'clone' website, where you're asked to enter your login information. The scammer can then use this info to access your account on the actual website. Pay-pal is extremely vulnerable to this kind of scam.

Other false links will lead you to .exe files, like this one. These are programs that you are inadvertently installing on your computer, and they could be viruses, spyware programs, or even programs designed to raid your computer for your personal information and email it back to the sender.

These false emails are very dangerous. Please, take the extra moment to be sure of the site you're about to visit before clicking. It can save you a lot of trouble later.

Published by Bryan Belrad

The mind behind Zero Sum Theory, author of best-selling fiction and non-fiction, see what else he's up to on Facebook.  View profile

You can hover your cursor over a link to see where it goes BEFORE clicking it. Check to see if it links to the site it claims before you visit, or you might regret it later.

16 Comments

Post a Comment
  • Dom10/8/2010

    Thanks guy, you have saved me lots for this info :)

  • Lauren5/3/2010

    I got an email similar to this today. I was pretty confused because I suspected it was a virus, but when i checked the links, they led to HTML things. the sender was webmaster@hallmark.com and the IP address, when I googled it, led to two websites - one called Phishtank and the other called Malwaredomainlist. I was about to look into it more just to make sure - then I noticed that the subject of the email spelled 'greeting' wrong ('greeding'). LOL

  • Jeff3/21/2010

    When I looked at the "full Header" I found the IP address (209.31.109.162). I then googled it to find a site called: Love2Trade: Multi Family Homes. RED FLAG! Leery about checking out the site directly, but will see what else is out there on it.

  • sjc11/23/2008

    Just recieved another Ecard from Hallmark.co.uk, and when you hover over the "click here" no link shows up, To determine whether this is real or a hoax email .......Copy the whole email into Word and when you hover over the "click Here" this website link appears..http:cs.iceman.ro.hallmark.gif and the ending is EXE Hope this helps someone
    BUT DO NOT CLICK ON THE LINK.!!
    Good luck

  • sjc11/21/2008

    This is the website that it originates from, as I copied the whole email into Word and the email shows itself.. .....as I had opened it from my Inbox and got two viruses.. beroncho.com/hallmark.gif.exe
    This virus I have been informed..also goes into your email senders account and sends an e card to all your friends with deadly consequences... these people ought to be sent an Ecard themselves and see how they like it...!!!
    Hope this helps someone..

  • TC11/18/2008

    you got a virus called W32.Mytob@mm - W32.Mytob.@mm is a mass-mailing worm that uses it own SMTP engine to send an email to addresses that it gathers from the Windows Address Book on the compromised computer. The worm also has the ability to open a back door and spread through the network by exploiting vulnerabilities.

    I just got this email this morning. No header, but my email subject said : POSTCARD from HALLMARK - security risk found in message and when I opened the email, it went on to say that it deleted a file but left the email 'whole' and it advised me NOT to download the .exe file attached.

    So About.com and Snopes are both VERY wrong about this. They both put out there that this is a HOAX. I'm no dummy, this is a real one.

  • joe11/10/2008

    Just checked my e-mail and had message informing that a friend had sent me a ecard. Open the file but my anti-virus detected a virus and it was deleted . This card came from postcards@hallmark.com

  • dios`eneru10/28/2008

    yeah!..it is true..if you want i`ll send it to you ^____^v,,

  • fawn2002com8/31/2008

    The one I received had the downloadable file which read picFUNNY.gif.exe anything that is downloadable. if a new window opens it should only be a webpage. never place a password using a link, always directly use a web address before using password. I had 1500 dollars stolen that way

  • Donna8/4/2008

    it is very true!!!!!!!! I opened the file thinking it was a thoughtful card from a friend and now my laptop is going haywire!! It is trying to send out fake emails to all my friends in my contact list!! i changed all my passwords...

Displaying Comments
Next »

To comment, please sign in to your Yahoo! account, or sign up for a new account.