Google's Orkut Hit with a Javascript (Flash?) Worm

I haven't been able to find a copy of the source yet, but the method of transmittal looks pretty straightforward.

You get an email notification (or find out on Orkut) that you have a new scrapbook entry. It's from a friend. It says.

2008 vem ai... que ele comece mto bem para vc

There's no need to click on anything, just viewing it does the trick. The scrap deletes itself, and adds you to the Orkut Community "Infectados pelo Vírus do Orkut". That group, as I write this, is gaining members at a rate of at least one hundred per minute.

A quick (Google :-) translation of the description of the group produces the following:

CALMA!
If you came into this community, make sure that no data was stolen and not your will, that is not my goal.

If I are sure at the end of all, this community should is lotada of people.

This just to show how orkut may be dangerous, you came up here without clicking absolutely no link malicious, everything was done reading scraps.

Orkut allows friend-to-friend scraps to contain HTML. Presumably there's a bug somewhere in the HTML filter which is allowing malicious Javascript to get through.

It does not appear at first glance that the worm does anything more dangerous than pass itself on to one or more of your friends. I think it unlikely that it would be able to steal your password, although it could potentially access other private information.

[Update. According to a posting on the Community site by the author of the virus, it can be blocked by blocking Flash.]

How to protect and not return more Well, many people do not like to join the community, is a right that you have, although it is only a joke. But, just as I am doing it, someone else can do to try to hurt someone. As some people asked, I will teach how to protect here. Firefox (easier): - Install the extension Flashblock [Https: / / addons.mozilla.org/en-US/firefox/addon/433] - Restart Firefox and ready If you do not have Firefox, download here: Http://www.mozilla.com/en-US/firefox/ Internet Explorer: - Go to the Tools Menu-> Internet Options - Click on the Security tab - In Zone of web content let selected Internet - Click Custom Level ... - Find the part where is Plugi-ins and ActiveX controls of the - Disable the option Run controls and plugi-ins of ActiveX With that you will no longer see for example the videos from YouTube, both in and outside Orkut, but at least you will be safe. I suggest you download Firefox because it is easier to enable and disable.