Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

miSan

macrumors newbie
Original poster
Jul 16, 2014
3
0
Has anyone ever seen the Hornyworm virus (the message itself calls the worm a virus, but I digress) and if so, do you have any information on it?

My sister-in-law has an iPhone 5 and when she opened up Safari this morning to go to the Internet she received a pop-up labeled com-0.mobi along with a message "Fatal Virus Hornyworm.apk has infected your phone... (see attached image).

A few strange things about this, the first is the title of the supposed worm in that the .apk is an android file (package installer). Also, the image shown is the green droid. I had her do a hard reset thinking maybe there is an app that installed itself via a drive-by on an infected site (malvertising or something like that). She did that, but as soon as she went to the Internet, a bunch of sites opened up and another message was displayed. At the top is meow://com-0.mobi along with the message "Warning: your iPhone is attacked by Hornyworm.apk!... (image is attached). Again, this references android (the .apk file) and one of the tabs opened is an "Android Warning".

I have never seen an actual iPhone infection (or whatever this is) and certainly not one that is android themed (the green droid, the .apk, etc.). I'm not familiar with iOS. I'm thinking her best bet is to go to iTunes and re-image the phone, but I'm curious to learn what this is and what type of infection it is. I wanted to check the browser home screen settings, but there doesn't appear to be an option to check or change it.

The worm/virus or whatever this is is popping up porn sites as well (hence, the name of the worm). Thoughts?
 

Attachments

  • att_1405531531663147.png
    att_1405531531663147.png
    36.3 KB · Views: 1,089
  • att_140553154136750.png
    att_140553154136750.png
    68.7 KB · Views: 2,268

swordfish5736

macrumors 68000
Jun 29, 2007
1,898
106
Cesspool
You could start by clearing out the cache and history in Safari.

Has she clicked any odd links or visited any questionable websites recently?
 

Janichsan

macrumors 68040
Oct 23, 2006
3,039
11,026
It's definitely not a legit warning and definitely not an infection with Android malware.

I would guess it's most likely just some website pushing itself in the foreground. Closing all tabs in Safari (which normally are kept when you re-boot the phone, so that wouldn't help) and possibly clearing the browser cache might help.
 

miSan

macrumors newbie
Original poster
Jul 16, 2014
3
0
She hasn't gone to any questionable sites, but I'm guessing it is malvertising or an infected iFrame on a legit Website or something like that. I knew it wasn't an actual piece of malware, per se, and certainly not a virus. Janichsan, I was thinking the same as you, which is why I was curious to see if it was possible to view the homepage settings in Safari as something is pushing it to the foreground. Just found it amusing that it referenced android, which is another clue that I don't think there is malware installed. I'm thinking it is a website pushing itself to the foreground somehow or an app got installed changing her homepage settings. But that isn't possible with iOS, correct? She would have had to manually install something, which would require her phone to be jailbroken, correct? I did have her clear history, cache, and data before, but it came back.
 

Janichsan

macrumors 68040
Oct 23, 2006
3,039
11,026
She hasn't gone to any questionable sites, but I'm guessing it is malvertising or an infected iFrame on a legit Website or something like that.
Unfortunately, crap like this also comes up on normally legitimate websites, including some popular humour and/or kitten picture sites. Normally it's really coming from an ad. I don't have the impression that some sites check the ads they get to display very closely…

Janichsan, I was thinking the same as you, which is why I was curious to see if it was possible to view the homepage settings in Safari as something is pushing it to the foreground. Just found it amusing that it referenced android, which is another clue that I don't think there is malware installed. I'm thinking it is a website pushing itself to the foreground somehow or an app got installed changing her homepage settings. But that isn't possible with iOS, correct? She would have had to manually install something, which would require her phone to be jailbroken, correct? I did have her clear history, cache, and data before, but it came back.
Mobile Safari really has indeed no option to set a default homepage (unless you jailbreak the phone and dig deep in the settings), so it shouldn't be possible for a website to change anything there.

Normally, a webpage only should pop up again when the corresponding tab has not been closed, that's why I suggested making sure all tabs are closed. Clearing the history, cache and data will not make Safari forget the tabs you had open when closing and/or rebooting the last time.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.