iPhone iPhone 5 Infected with Android Themed Malware?

[miSan]

Has anyone ever seen the Hornyworm virus (the message itself calls the worm a virus, but I digress) and if so, do you have any information on it?

My sister-in-law has an iPhone 5 and when she opened up Safari this morning to go to the Internet she received a pop-up labeled com-0.mobi along with a message "Fatal Virus Hornyworm.apk has infected your phone... (see attached image).

A few strange things about this, the first is the title of the supposed worm in that the .apk is an android file (package installer). Also, the image shown is the green droid. I had her do a hard reset thinking maybe there is an app that installed itself via a drive-by on an infected site (malvertising or something like that). She did that, but as soon as she went to the Internet, a bunch of sites opened up and another message was displayed. At the top is meow://com-0.mobi along with the message "Warning: your iPhone is attacked by Hornyworm.apk!... (image is attached). Again, this references android (the .apk file) and one of the tabs opened is an "Android Warning".

I have never seen an actual iPhone infection (or whatever this is) and certainly not one that is android themed (the green droid, the .apk, etc.). I'm not familiar with iOS. I'm thinking her best bet is to go to iTunes and re-image the phone, but I'm curious to learn what this is and what type of infection it is. I wanted to check the browser home screen settings, but there doesn't appear to be an option to check or change it.

The worm/virus or whatever this is is popping up porn sites as well (hence, the name of the worm). Thoughts?

 

[swordfish5736]

You could start by clearing out the cache and history in Safari.

Has she clicked any odd links or visited any questionable websites recently?

 

[Janichsan]

It's definitely not a legit warning and definitely not an infection with Android malware.

I would guess it's most likely just some website pushing itself in the foreground. Closing all tabs in Safari (which normally are kept when you re-boot the phone, so that wouldn't help) and possibly clearing the browser cache might help.

 

[miSan]

She hasn't gone to any questionable sites, but I'm guessing it is malvertising or an infected iFrame on a legit Website or something like that. I knew it wasn't an actual piece of malware, per se, and certainly not a virus. Janichsan, I was thinking the same as you, which is why I was curious to see if it was possible to view the homepage settings in Safari as something is pushing it to the foreground. Just found it amusing that it referenced android, which is another clue that I don't think there is malware installed. I'm thinking it is a website pushing itself to the foreground somehow or an app got installed changing her homepage settings. But that isn't possible with iOS, correct? She would have had to manually install something, which would require her phone to be jailbroken, correct? I did have her clear history, cache, and data before, but it came back.

 

[Janichsan]

She hasn't gone to any questionable sites, but I'm guessing it is malvertising or an infected iFrame on a legit Website or something like that.

Unfortunately, crap like this also comes up on normally legitimate websites, including some popular humour and/or kitten picture sites. Normally it's really coming from an ad. I don't have the impression that some sites check the ads they get to display very closely…

Janichsan, I was thinking the same as you, which is why I was curious to see if it was possible to view the homepage settings in Safari as something is pushing it to the foreground. Just found it amusing that it referenced android, which is another clue that I don't think there is malware installed. I'm thinking it is a website pushing itself to the foreground somehow or an app got installed changing her homepage settings. But that isn't possible with iOS, correct? She would have had to manually install something, which would require her phone to be jailbroken, correct? I did have her clear history, cache, and data before, but it came back.

Mobile Safari really has indeed no option to set a default homepage (unless you jailbreak the phone and dig deep in the settings), so it shouldn't be possible for a website to change anything there.

Normally, a webpage only should pop up again when the corresponding tab has not been closed, that's why I suggested making sure all tabs are closed. Clearing the history, cache and data will not make Safari forget the tabs you had open when closing and/or rebooting the last time.

 

[KingShoot007]

Wrong forum. This is for iOS 5. For iPhone questions, go here