An E-Card from "VIRUS"

I think I've been attacked by a greeting card. Well, it claimed to be a greeting card.

I received an email with the subject: "You've received an ecard from a Partner!" That sounded nice -- who wouldn't want an e-card from a Partner? So I clicked into that message.

Inside it says, "Hi. Partner has sent you an ecard." Then there's a bunch of explanation about how to visit the card, and about how awesome it will be. There is a link to click, a URL that will take me to my awesome e-card from a Partner. I'm getting excited already!

At the bottom it is signed:
"Postmaster,
dgreetings.com"

The URL however does not say dgreetings.com. It gives a hexadecimal address. That's a little fishy, no? Maybe. Well, I clicked the link. And then I had second thoughts. Another browser window had already launched, so I clicked the Stop-Loading button. I decided to visit dgreetings.com directly, rather than the URL they provided.

It turns out dgreetings.com looks like a real e-card site, and it appears to operate in India. I didn't spend a lot of time there. I decided to go ahead and click the link in the email. I couldn't wait to see how much a Partner appreciates me.

It loaded a page that looked like a redirect message. It said something like (and I'm trying to remember without clicking the link again), "We are testing a new browser function. If you do not see your card, click THIS LINK." That's where I stopped cold. Because the link directed to that hexadecimal domain, slash, an executable. I think it was "ecard.exe".

I'm not going to click that.

Has anyone else seen this yet? Just before writing this I Googled "dgreetings partner" and didn't find anything relevant to a known email virus/trojan/worm. So I thought I would put some information up and see if it means anything to anyone else.
-=-