Here are some more variation of wall post phrases that this worm seems to be using while spreading on Facebook:

1. OMG <your facebook profile name> you should untag yourself in this vid
2. OMG <your facebook profile name> why are you in this vid
3. hey <your facebook profile name> you look so stupid in this vid
4. hey <your facebook profile name> why are you in this vid
5. hey <your facebook profile name> i can’t believe youre tagged this vid
6. ROTFL <your facebook profile name> what are you doing in this vid

When the user clicks on the video, it seems to be loading in an enlarged video player window.

But the real problem starts when the user clicks on the apparently innocent ‘Play’ button on the enlarged video screen. Once you click the Play button, it does not play any video, but instead displays a message that reads, “Select Address bar.  Press Ctrl+V. Press Enter.“

But here is what it does in the background. As soon as the user had clicked on the first video link, it starts scanning the user’s friends list and generates a malicious code, which the worm copies into the clipboard memory.

When the user selects the address bar and presses <CTRL>+<V> (which is the keyboard shortcut for paste) then <ENTER> , he/she ends up posting a similar OMG why are you tagged in this vid type message on one of his/her friend’s Wall.

At this moment, it is not yet known what kind of data, apart from your friends list, is accessed by the worm. But knowing some of the past Facebook worms and their malicious abilities, the possibilities of this OMG/WTF worm can be scary!

So how to prevent this spam? Simple, don’t click on any suspicious links in Facebook however attractive it may appear! Hackers are just exploiting the curious nature of human mind to good use in doing their job. To avoid getting such malicious wall messages, you may restrict other people (who are NOT your friends and not in your contact list) from posting on your wall. For doing this, choose:

“Account -> Privacy Settings -> Customize Settings -> Things others share -> Friends can post on my Wall ( Enable / Disable ).”

Norman Virus Control uses the revolutionary technology to detect new viruses before pattern files are available. As a part of the Norman Virus Scanner, the Norman SandBox inserts any suspicious file into a simulated computer, complete with emulated network connections, where Norman monitors the actions of the file in real-time, enabling it to behave as if it were in a live environment. Furthermore, Norman also comes with automated Internet update function. It will protect you from the most common types of malware such as viruses, worms, trojans, etc even if they are new. However, unfortunately, the Norman Virus Control security software currently not support for Windows 7 operating system.

Features of the Norman Virus Control:

- Email scanning for malicious programs
- Real-time scanning of files
- Norman SandBox technology to include detection of unknown viruses, Trojans and worms
- Automatic Internet update

As mentioned earlier, Norman Virus Control normally cost $39.95 to purchase. As part of promotional offer, now everybody can grab the free Norman Virus Control 3 year license serial code by following the steps below.

1. To grab the free Norman Virus Control, just visit this registration page.

2. Enter your name, valid email address, OEM code as FSC536, and other information in the box, and then click “Submit” button. Note: The OEM code is essential for registration process.

3. Check the inbox that will receive an email from “Norman Web” with free 36 months license serial code. ‏

4. Download and Install Norman Virus Control, and activate it using the license serial.

5. Install the Norman Virus Control and enter the license code and enjoy free full version Norman Virus Control for 36 months.

Norman Virus Control supports Windows NT, Windows 95/98/Me, Windows XP, and Windows Vista.

A Dutch internet service provider has identified a worm that installs a backdoor on jailbroken iPhones and makes them part of a botnet. The Dutch ISP has reported unusual amounts of data traffic related to the worm, which was the first indication that something was wrong. Slashdot posted a link to a translation of a Dutch security blog post with more details.

The worm, according to XS4ALL, targets jailbroken iPhones whose owners have carelessly failed to change the default password. In addition to connecting to a Lithuanian master command channel, it also changes the root password for the device, making it harder for owners trying to regain control. Infected iPhones are also tagged with a unique ID number, which allows the attackers to further investigate a phone found to have interesting content. This could lead to significant data theft if a sensitive phone has been jailbroken.

This worm, like the others, only attacks jailbroken iPhone and iPod Touch devices. Hence, we repeat again – if you are using a jailbroken iPhone or iPod Touch device, change the default password now. The most notable about this new worm is that it uses command-and-control like a traditional PC botnet. It configures two startup scripts, one to execute the worm on boot-up, and the other to create a connection to a Lithuanian server (HTTP) to upload stolen data and cede control to the bot master.

This worm can find vulnerable iPhones on a wide range of IP addresses, including IPs in several different countries, for example the Netherlands, Portugal, Australia, Austria, and Hungary. Furthermore, it changes the root password on the iPhone to “ohshit” (as discovered by Paul Ducklin, head of technology in Sophos Asia Pacific.)

The new worm is called “Duh” or “Ikee.B”, and it uses the exact same vulnerability as the first one. The worm allegedly changes the root password from the default of “alpine” that Apple set in the factory firmware, making it more difficult for users to secure their devices. The fix is thus identical. The recommended method to remove this malware from your iPhone is to change the root password in the SSH application to something other than the default, which is “alpine” and restore the Apple factory firmware using iTunes. Of course, iPhones that are reset will no longer be jailbroken, but that’s certainly a better alternative than being part of a botnet.

The worm could be related to Banker Trojans as well, as it appears to look for mTANs. These are two-factor authentication systems that use SMS. When you attempt to log in to your bank’s website, the bank sends you an SMS with a one-time password, which you then enter on their website to log in to your account.

The worm tries to propagate by scanning a variety of IP ranges, including those used by carriers T-Mobile, UPC in the Netherlands, and Optus in Australia. The worm is especially active when it has access to wi-fi networks. One tip-off that a device has been infected is that battery life is extremely short when connected to 802.11 networks because the worm generates so many connections. The worm is not widespread though, as it appears at the moment.

However, users who haven’t jailbroken their iPhone or haven’t installed the SSH application are not affected by this vulnerability.

A hacker who calls himself/herself iKex has recently created what apparently is the first iPhone worm, and it’s currently infecting jailbroken iPhones across Australia. The attacks, which researchers say are the world’s first iPhone worm in the wild, target jailbroken iPhones that have SSH software installed and keep Apple’s default root password of “alpine.”

In addition to showing a well-coiffed picture of Astley, the new wallpaper displays the message “ikee is never going to give you up,” a play on Astley’s saccharine addled 1987 hit “Never Gonna Give You Up.” Once the iKee worm changes your wallpaper it tries to install itself on other jailbroken iPhones on the network. If you have been affected, luckily there is no harm done as this virus was more of an experiment than anything else.

This is how apparently the iKee worm operates:
Once an iPhone has been infected by ikee, it automatically starts searching for other iPhone’s on the cellular network that use the root:alpine username/password combination. Once it finds another vulnerable iPhone, it installs itself and begins the process again and this goes on like a nuclear chain reaction. ikee virus will disable SSH access on your iPhone and will change the background image to that of “Rick Astley” as can be seen in the screenshot above.

How to Prevent your iPhone from iKee Worm (and other similar worms in future)?
To protect your jailbroken iPhone or iPod touch from ikee worm attack or any other similar attacks in the future, you must change your default SSH password (that is “alphine“) now.

How to Remove iKee Worm and Change Default SSH Password in your jailbroken iPhone?
- Go to Cydia and search for MobileTerminal app and then install it on your iPhone. You can directly install it from here though. Once you have successfully installed MobileTerminal, reboot your iPhone.

- Start MobileTerminal app and type the following command to change the root password

login

Press enter. And then type

root

as your login and ‘alpine‘ as your current root password. After logging in, Type

passwd

Press enter.

- It will now prompt you to enter a new password (twice). Simply enter your desired new password again.

That is it. It should all be fine and now your iPhone should be free from ikee worm. Cheers

Let us hear how it worked for you.