Saturday, September 25, 2010

Solution for Orkut worm Bom Sabado!

Today orkut users were flooded with scraps telling Bom Sabado!. Unlike other malware, this doesn't need you to click a link. Just by opening Orkut profile of the affected user, you will be affected. So I suggest you not to use orkut till this problm is fixed. However, if you are already affected, you can get rid of this using the following steps. (This is applicable only for Firefox users. If you are using any other browser, see below):
  • Download AdBlock Plus add-on for Firefox and install it.
  • Restart the browser to enable AdBlock.
  • You will see a red icon with ABP on the right hand side of the search box in Firefox.
  • Click on that, and select Preferences.
  • Click Add Filter and enter *tptools.org/*.

Now you can safely open orkut.

You may have to remove yourself from the communities added by the worm, such as saadzin, meu miguxinho, O vírus que contagia, Eu tenho um grande AMOR, Juizo eu TENHO, só não USO!, Dino ♥ etc.

Note: The "Old Orkut" users are not affected by this worm, and are safe.

If you are not using Firefox, then you can follow the following steps:

Update: The website tptools.org is down now. Orkut is beautiful, again :-)


If you have a browser other than firefox, or to ensure that site won't get accessed by any other way, you can edit hosts file and adding the following lines:

127.0.0.1 tptools.org
127.0.0.1 www.tptools.org

hosts file is found in:
  • C:\Windows\ - Windows 95, 98, Me
  • C:\WinNT\system32\drivers\etc\ - Windows NT, 2000, XP Pro
  • C:\WINDOWS\System32\drivers\etc\ - Windows XP Home, Vista, 7
  • /etc/ - Linux