From: <russian_weasels@we_love_malware.com>
To: <luser@american_company.com>
Date: Monday - March 3, 2008 2:54 PM
Subject: You have just received an ecard.
This Funny Ecard has been sent to you http://xx.xxx.xx.xxx/

******************************************

What a nice day, eh?

Message above is pegging us - contains random From and IP addresses...

Of course, my users have been clicking the above url - THEN asking me about it. I've blocked the subject now, but it bothers me a bit that Google/Postini isn't picking up on it, and SOPHOS isn't detecting whatever crud is being installed. Does not look legit to me....