Saturday, September 25, 2010

Solution for Orkut worm Bom Sabado!

Today orkut users were flooded with scraps telling Bom Sabado!. Unlike other malware, this doesn't need you to click a link. Just by opening Orkut profile of the affected user, you will be affected. So I suggest you not to use orkut till this problm is fixed. However, if you are already affected, you can get rid of this using the following steps. (This is applicable only for Firefox users. If you are using any other browser, see below):
  • Download AdBlock Plus add-on for Firefox and install it.
  • Restart the browser to enable AdBlock.
  • You will see a red icon with ABP on the right hand side of the search box in Firefox.
  • Click on that, and select Preferences.
  • Click Add Filter and enter *tptools.org/*.

Now you can safely open orkut.

You may have to remove yourself from the communities added by the worm, such as saadzin, meu miguxinho, O vírus que contagia, Eu tenho um grande AMOR, Juizo eu TENHO, só não USO!, Dino ♥ etc.

Note: The "Old Orkut" users are not affected by this worm, and are safe.

If you are not using Firefox, then you can follow the following steps:

Update: The website tptools.org is down now. Orkut is beautiful, again :-)


If you have a browser other than firefox, or to ensure that site won't get accessed by any other way, you can edit hosts file and adding the following lines:

127.0.0.1 tptools.org
127.0.0.1 www.tptools.org

hosts file is found in:
  • C:\Windows\ - Windows 95, 98, Me
  • C:\WinNT\system32\drivers\etc\ - Windows NT, 2000, XP Pro
  • C:\WINDOWS\System32\drivers\etc\ - Windows XP Home, Vista, 7
  • /etc/ - Linux

Like the post? You may want to...
Digg this

10 comments:

Shubham Shastri said...
This comment has been removed by a blog administrator.
sunaath said...

Are there other such filters useful to prevent worms in Firefox and IE?

Harish - ಹರೀಶ said...

@Sunaath uncle, this worm had its code in http://tptools.org/worm.js
That's why it should be added to the black-list.

If any other virus has any other site, that site can be blocked in Ad-block Plus.

Manjunath said...

Hey thank u harish for the information... i got some srcaps from my friends... i was thinking wat is the meaning of the word "
Bom Sabado!" :) :)

Harish - ಹರೀಶ said...

@Manju, Bom Sabado means "Good Saturday" in Portuguese. I hope you didn't get affected with this worm.

ಪ್ರಸನ್ನ ಶಂಕರಪುರ said...

Very useful information, thank you.

-Prasanna

Abhirup said...

http://tptools.org/worm.js

is not the only worm...there are many othr jus popping up now and then

anyhub.net

any many more using the same technique....

so this is not a solution

Harish - ಹರೀಶ said...

@Prasanna, Thank you

@Abirup, of course yes.. We need to add those websites also when we find them.

SWATI said...

It was a very nice idea! Just wanna say thank you for the information you have shared. Just continue writing this kind of post. I will be your loyal reader. Thanks again. and welcome to my Blog:


FREE INTRADAY TIPS

Manjunatha Kollegala said...

Dear Harish,

Thanks for your comments on my blog. I have posted a reply