Recipients who click the link provided in the email or Instant Message will be invited to install an application dubbed "Internet Optimizer" (IO). As part of the installation process, users must agree to the End User License Agreement (EULA). The EULA gives Avenue Media permission to send similar messages to all of their email and Instant Messenger contacts.
In addition, agreeing to the EULA gives Avenue Media the right to remote access, including the ability to update or install new programs. Though not a virus, these programs are often referred to as Internet parasites and fall into the category of Spyware and Adware.
"The makers of this email nuisance appear to have been inspired by the Friends Greeting incident last October, which affected thousands of internet users," said Chris Belthoff, senior security analyst at Lynnfield, MA-based Sophos, Inc. "Just like then the people behind this are taking advantage of the public's reluctance to read 'legalese' and fine print."
According to Sophos, the legalese in question includes:
"In consideration for viewing of video content, Avenue Media may send email to your Microsoft Outlook contacts and/or send instant messages to your IM contacts offering the video to them on your behalf. By viewing the video content, you expressly consent to said activity."
"For your convenience, [IO] automatically updates itself and any other [IO]-installed software to the latest available versions at periodic intervals. In consideration for this feature, you grant Avenue Media access to your machine to automatically update [IO], add new features and other benefits, and periodically install and uninstall optional software packages."
The agreement to allow Avenue Media access to your computer to update and install code as it sees fit is particularly disturbing," continued Belthoff. "The decision about whether to grant such permission should only be made by an IT department fully aware of the consequences, not a user frantically clicking 'next' on a license agreement in their hurry to see a movie of Bill Gates being splattered with custard."
Three modules are initially involved, dubbed App/ViewMov-A, App/Optimiz-A and App/CrmRest-A by Sophos. Internet Optimizer loads via the system registry, modifying the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key to run whenever the system is restarted. Because installation also grants Avenue Media the right to install or udpate the software, other components may be present and these may vary from machine to machine. The mass-mailing routine can result in high amounts of email traffic which could pose problems for enterprises and ISPs. To prevent this, IT managers can block access to www.movies-etc.com, the site responsible for hosting the parasitic files. A second site affiliated with Avenue Media is www.internet-optimizer.com.
