Bom Sabado

Bom Sabado Virus hits ORKUT. Bom Sabado (means 'Good Saturday' in
Portuguese) is an orkut virus. I am requesting users that Do NOT Open
your ORKUT account till the bug is fixed. I will give you an all clear
message on my twitter account.
Bom Sabado is a cookie stealing virus. Those who are affected by this
virus try to change their password as soon as possible and also clean
your browser cookies. Orkut officials havn't given out any details of
the scrap virus. Its safe to keep away from opening your orkut until
orkut official give out the status of the attack. If anyone reads this
scrap even in their profile, their cookies are also stolen and so they
are also posting scrap automatically to their friend list as scrap
bomb !!!
How it works ?
When any one open page that is infected by this worm. A JavaScript
will run automatically. Your browser will be hanged for some minutes
on seconds. That script will automatically join you his communities.
here you can see links of these communities.
After joining communities it will send scrap to your friends with text
"Bom Sabado!" with a iFrame code which load that JavaScript again for
your friends and they will join communities and send links to their
friends.
With scrap Bom Sabado! it loads a small iFrame code. It loads
JavaScript from http://tptools.org/worm.js
The Code was...
Solutions:-
Follow these steps:
1. Immediately change your password and security question{ including
secondary email and mobile number if they also got changed.) This will
solve the problem.
2. Find out whether some communities has been joined automatically. if
yeah, do remove them.
3. If your account has been completely hacked, see here: Orkut account
hacked / How to get back hacked Account / Orkut Account taken over by
someone
Advanced Solution:-
Open your Host file with notepad
Windows 95/98/Me --> c:windowshosts
Windows NT/2000/XP Pro --> c:winntsystem32driversetchosts
Windows XP Home --> c:windowssystem32driversetchosts
Windows 7 –-> C:windowssystem32driversetchosts
Add this code at the end
127.0.0.1 tptools.org
127.0.0.1 www.tptools.org
All Clear: The site tptools.org was hosted on Hostgator. It is now
down due to complaint. So the script wont work anyomre. So... Happy
Orkuting again !