Beware Of Scrapkut Virus!

How dose a WORM named SCRAPKUT targeting Orkut users ?

1. A malicious scrap message which is posted to victim’s scrapbook.
2. Clicking on the link, redirected to some malicious website which prompts you to download the file “flashx_player_9.8.0.exe” disguised as a flash upgrade.
3. The victims whole system comes under the virus attack.
4. When a user visits Orkut and starts a session from the infected system, maindwxp.exe injects Javascript code into the active Orkut web session and executes in context of the Orkut domain and user authenticated session.
5. And your friends end up getting fake mails (ones you never sent) from you, which starts over again. 

 The cyber security wing of the department of information technology (DIT) has suggested all Orkut users refrain from downloading any fake link to YouTube video looking as if it is from a known member of its friend list, The active Orkut virus was tracked on Friday last week while other viruses have been active on several other social networks for a few weeks now.
Similar attacks on Facebook, MySpace and Yahoo! MediaGrid have also come to light in recent weeks. On Facebook and MySpace, the user may be caught unawares while uploading photographs. After executing the malicious binary code, disguised as flash memory, the Scrapkut virus downloads further binaries-windosre-mote.exe, logservicess.exe and win32chekupdate.exe - to perform malicious actions on victim system. The downloaded file logservicess.exe copies itself as maindwxp.exe to different locations to ensure its execution on every start-up of infected system.

Here's how you can PROTECT YOURSELF:

1) Orkut users should remain cautious while visiting any link provided in there scrapbook.
2) Keep anti-virus and antispyware signatures up-to-date.
3) And most important of all do not visit untrusted websites. Read more on this article...

Labels:

Orkut Security [Virus Alert]: Scraps and Fake Websites Can Hack Your Orkut Account and Community

This time the alarm is real. There is a link circulating malicious orkut plugins. That link asks you to install a plugin, which claims to help you in orkutting. And now if you accept, you get infected! The virus generally reaches Orkut users via scraps, left by a friend of the person, who might have clicked on the virus before. And after your click, the virus will automatically send those malicious scraps to your friends.

This thing works like a pyramid system. If you get infected, infected scraps will be posted in all your friend's scrapbooks automatically and so on. So, this Orkut Virus is infecting Orkut users rapidly.



How Orkut Virus Hacks Orkut User's Accounts and Communities :

This virus asks you to click on a link. Those links also claim to do some uncommon things like Scrap to all or something like this. Upon Clicking, it will open a page in the same window. Then it will ask you to us to choose from varieties of services on that new page. Like 1. Scrap2all 2. Animated Testimonials 3. Install Orkut Themes etc. If you click on any those links, it will take you a page like Orkut.com. But just check that URL. That's not Orkut.com. That will be something like 0rkut.com (Zero[0] instead of O) or Orukt.com (Check the spelling). And now-a-days they are using URLs in a new style, so that anyone can not even do a doubt. Like, http://www.orkut.communty.com (Yes, this is a single URL and check the spelling here again. They use different tricks not to grab your attention and try to make that site look like the original Orkut.com. Now if you enter your ID and Password on that Fake Orkut login page, they will steal your e-mail ID and password, that you use to access Orkut and different Google services. And now after having your Orkut User name and Password, you can imagine what they can do with your account! Click on the below screenshot to enlarge.

The above scrap tells you about a community that was created for you:

Check out the whole of the scrap-trap:

Hi, I've created a community for you, see if at least part tá. www. orkut.comunnyti.com/comunnyti.aspx? cnn = 32154 (note the wrong address that begins with www. orkut to deceive).


How to Keep your Orkut Account Safe and Avoid Orkut Virus:

Remember the most important tip: Always check the destination link before clicking! To do this, place your mouse over the link, and observe the address that appears in the lower left corner of your browser. Check out the exact field, view twice, because those virus makers create such links that can confuse people very easily.

For example, the address of the virus is ORKUT.COMUNNYTI.COM, while the official address of orkut is only ORKUT.COM. New Orkut users can get confused easily with these kind of links.

Now, I have warned you. Do not click on any of those links you get on your scraps. Some readers of the Journal Orkut.etc.br (Orkut Link For People in Brazil) complained that after installing this plugin, they got their communities stolen and even profiles deleted. Also, one of them was infected with a Trojan Horse (Trojan horse) that required the formatting and resettlement of Windows XP.

Prevention is always better than cure. Hence, NEVER CLICK ON ANY LINKS. And if you have ever faced these kind of things in your Orkut life, kindly use the comment section and share your experience. And if anyone of you have already got your Orkut profile deleted or Orkut communities stolen, mention here. I will be glad to assist you and will try to get that back for you. Read more on this article...

Labels:

How to remove ORKUT IS BANNED [heap41a (anti firefox)] virus

This virus heap41a not only blocks Firefox but also Google sites like Orkut, Youtube & some other too except Google.com. If you open any of these sites in any other browser it closes down the browser & again gives a message "Orkut is banned you fool, The administrators didn't write the program guess who did? Muhahaha!!!" or "I didn't hate Mozilla but use IE or else".


This virus is not a hardcore type virus means it doesn't cause any serious harm but tries to reduce or finish the use of firefox or Google group.



How to remove Heap41a virus :

1. Go to c:/heap41a
2. You will see some files in that folder naming Reproduce.txt, Copy.txt, etc.
3. Just delete all the files present there in that folder.
4. Some file may not be deleted as they may be currently running on your system.
5. Reboot your system & keep pressing F8.
6. Select Safe Mode with Command Prompt.
7. After logging in you will the command prompt window.
8. If your default directory shown there is not “C:\” then type “cd\” & hit enter.
9. Now type this command “del heap41a”.
10. Now reboot your system & start the windows normally. Your system is now free from heap41a virus.

Now you can access google services and firefox also.

Source : JaysTech
Read more on this article...

Labels: