iPA Explains: De-Worming Your iPhone

If you jailbroke your iPhone, you understood there were both positive and negative elements to doing this. Still, if you’re staring at a picture of Rick Astley that you never installed or the new iPhone worm is sending personal information out to others, you’re in a bit of a bind and need to remove them.

Presently, the three known worms out there for the iPhone are as follows: Ikee changes your wallpaper to Rick Astley, iPhone/Privacy.A pores through all your personal information, and the third as-yet-unnamed worm copies your personal data and redirects online banking customers of a Dutch bank to a fake phishing website.

If your wallpaper has a picture of a dashing young man underneath the text “ikee is never gonna give you up”, your iPhone is infected with the Ikee worm.

If your iPhone’s battery life has been strangely short lately, your iPhone might have the third worm, which is constantly running a background process that attempts to spread itself to other vulnerable iPhones. Also, if you tried to change your root password and it didn’t work, you most likely have this worm – it changes the default ssh password once it infects your iPhone.

Getting rid of the ikee worm is the least painful of the three and can be done via the following steps:

-Start by downloading the MobileTerminal app from Cydia and installing it on your iPhone if you don’t already have it.

-Restart.

-Open up the MobileTerminal app and login under your root account (if you haven’t changed the password yet, the login is “root” and the password is “alpine”).

-Use the following commands to delete these files. These commands are case-sensitive, so be careful:

rm /bin/poc-bbot
rm /bin/sshpass
rm /var/log/youcanbeclosertogod.jpg
rm /var/mobile/LockBackground.jpg
rm /System/Library/LaunchDaemons/com.ikey.bbot.plist
rm /var/lock/bbot.lock

If that doesn’t do it, an alternate version of the ikee worm requires you to remove these files instead:

rm /usr/libexec/cydia/startup
rm /usr/libexec/cydia/startup.so
rm /usr/libexec/cydia/startup-helper
rm /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist

If you removed the above four files, you’ll have to reinstall Cydia.

Users worried about iPhone/Privacy.A will need to rely on their antivirus software to catch it on their computers (Intego’s VirusBarrier X5 will catch it for the Mac) but it’s unclear if any of the big security software companies have addressed it yet.

For users infected with the third worm, there’s no fix at the present short of backing up your data and restoring your firmware to factory conditions.

[Via Macworld UK]

View the comments on the forum…