Orkut Users Being Silently Scammed and Robbed by Orc.Malware - Google’s Orkut Service Hotbed of Brazilian Malware   6/15/2006 - 1,212 views,

The Orc.Malware, primarily in Portuguese (for some reason Orkut has really taken off in Brazil), installs a message which pops up when you log into Orkut, and tells you “Oi… tudo bom? Como o orkut limita a quantidade de fotos que podem ser publicadas na minha conta, eu criei um slide com algumas fotos minhas, pra ver e so clicar clicar no link!!! - Sei que vai gostar”, which basically boils down to inviting you to “click here” to see some pictures, where “here” is, of course, somewhere you really shouldn’t click.

Once clicking on the Orc.Malware link, the user is presented with what indeed appears to be a graphic file, but in fact if the user opens it, it installs files called, innocuously enough, wzip32.exe and winlogon_.jpg. They may sound innocuous, but in fact they immediately start grabbing anything of value they can find on your machine, including access to online bank accounts.

Says the Spyware guide, “Make no mistake about it - this infection is a real nasty one. And worse still, it looks like the tip of a very ugly iceberg.”

You can read the full expose on the Google Orkut infection here, at Spyware Guide.