OK looks like it’s a new phish, out today:
http://maccabu.wordpress.com/2008/08/07/msn-virus-picfriendzcom81/
Also comes in disguise:
thatsyou.com
friendz.com
picfriendz.com
…probably more.
Bottom line, don’t type your MSN Messenger password into a website you don’t know!!
I wonder how this propagates. Does it really come from the PC of the “friend” who sends it you?
My bet is, it infects one, then uses that “friends” list to send to others, more people enter their password info and off it goes sending it to their friends etc, etc. The only thing I can really think of that it can be aimed at doing is collecting email addresses for spammers or for relay.