Prozac Online Buy Antabuse Cipro Online Buy Cymbalta Toprol XL Online Buy Cipro Elimite Online Buy Neurontin Nexium Online Buy Seroquel

Koobface is a vicious computer worm infection that is known to be distributed through use of social networks. Koobface worm may be downloaded through a promoted video codec that computer users are asked to download in order to view a particular video online. Installation of Koobface is known to take place without notice to the computer user in many cases.

Once Koobface is installed, it checks for social network cookies on the system to infect the victim’s profile. A system infected with Koobface will display popup notifications that attempt to alert the computer user of a codec error. Koobface worm may also be known as W32/Koobface.AZ, W32.Koobface and W32/Koobface.

Automated Detection for Koobface

Koobface Manual Removal Instructions

Stop Koobface system processes:

freddy71.exe
freddy72.exe
freddy39.exe
freddy48.exe
freddy56.exe
tag14.exe
sber18.exe
freddy70.exe
ld06.exe
freddy64.exe
sber17.exe
freddy69.exe
freddy66.exe
freddy68.exe
freddy67.exe
ld15.exe
mstre22.exe
freddy65.exe
freddy61.exe
freddy63.exe
pp12.exe
nl15.exe
websrvx.exe
freddy62.exe
freddy60.exe
freddy59.exe
ld14.exe
mstre21.exe
freddy58.exe
pp11.exe
higeorge12.exe
ld12.exe
freddy49.exe
ld11.exe
ld10.exe
captcha6[1].exe
romeo15.exe
freddy46.exe
ld09.exe
freddy45.exe
mstre19.exe
%SYSTEMROOT%\\freddy43.exe
%SYSTEMROOT%\\pp10.exe
%SYSTEMROOT%\\system32\\sysdll.exe
pp10.exe
freddy43.exe
%SYSTEMROOT%\\pp07.exe
pp07.exe
tag11.exe
freddy42.exe
%SYSTEMROOT%\\mstre18.exe
mstre18.exe
%SYSTEMROOT%\\freddy41.exe
%SYSTEMROOT%\\ld08.exe
freddy41.exe
ld08.exe
%SYSTEMROOT%\\ld07.exe
ld07.exe
%SYSTEMROOT%\\pp06.exe
mstre15.exe
freddy40.exe
pp06.exe
%SYSTEMROOT%\\freddy40.exe
%SYSTEMROOT%\\ld03.exe
ld03.exe
%SYSTEMROOT%\\pp05.exe
pp05.exe
%SYSTEMROOT%\\mstre15.exe
%SYSTEMROOT%\\pp04.exe
%SYSTEMROOT%\\mstre12.exe
pp04.exe
%SYSTEMROOT%\\pp03.exe
pp03.exe
%SYSTEMROOT%\\pp02.exe
pp02.exe
%SYSTEMROOT%\\ld02.exe
ld02.exe
%SYSTEMROOT%\\pp1.exe
pp1.exe
%SYSTEMROOT%\\bolivar30.exe
bolivar30.exe
%SYSTEMROOT%\\bolivar28.exe
che07.exe
bolivar28.exe
%WinDir%\\system32\\nScan\\ekrn.exe
%WinDir%\\system32\\nScan\\ecls.exe
%WinDir%\\system32\\splm\\ncsjapi32.exe
%WinDir%\\bolivar28.exe
C:\\Windows\\fbtre6.exe

Unregister Koobface DLLs:

captcha7.dll
%WinDir%\\system32\\nScan\\ekrnEmon.dll
%WinDir%\\system32\\nScan\\ekrnScan.dll
%WinDir%\\system32\\nScan\\ekrnEpfw.dll
%WinDir%\\system32\\nScan\\ekrnAmon.dll
%WinDir%\\system32\\splm\\lmfunit32.dll
%WinDir%\\system32\\splm\\mcaserv32.dll
%WinDir%\\system32\\splm\\kbdsapi.dll

Remove Koobface files:

freddy71.exe
freddy72.exe
freddy39.exe
freddy48.exe
freddy56.exe
tag14.exe
sber18.exe
freddy70.exe
ld06.exe
freddy64.exe
sber17.exe
freddy69.exe
freddy66.exe
freddy68.exe
freddy67.exe
ld15.exe
mstre22.exe
freddy65.exe
freddy61.exe
freddy63.exe
pp12.exe
nl15.exe
websrvx.exe
freddy62.exe
freddy60.exe
freddy59.exe
ld14.exe
mstre21.exe
freddy58.exe
pp11.exe
higeorge12.exe
ld12.exe
freddy49.exe
ld11.exe
ld10.exe
captcha6[1].exe
captcha7.dll
Captcha7
romeo15.exe
freddy46.exe
ld09.exe
freddy45.exe
mstre19.exe
pp10.exe
freddy43.exe
sysfbtray
pp07.exe
tag11.exe
freddy42.exe
mstre18.exe
freddy41.exe
ld08.exe
ld07.exe
mstre15.exe
freddy40.exe
pp06.exe
ld03.exe
pp05.exe
pp04.exe
pp03.exe
pp02.exe
ld02.exe
pp1.exe
bolivar30.exe
che07.exe
bolivar28.exe
%WinDir%\\system32\\nScan\\ekrnEmon.dll
%WinDir%\\system32\\nScan\\ekrnScan.dll
%WinDir%\\system32\\nScan\\ekrnEpfw.dll
%WinDir%\\system32\\nScan\\ekrnAmon.dll
%WinDir%\\system32\\splm\\lmfunit32.dll
%WinDir%\\system32\\splm\\mcaserv32.dll
%WinDir%\\system32\\splm\\kbdsapi.dll
%WinDir%\\system32\\nScan\\em001_32.dat
%WinDir%\\system32\\nScan\\em000_32.dat
%WinDir%\\system32\\nScan\\ekrn.exe
%WinDir%\\system32\\nScan\\ecls.exe
%WinDir%\\system32\\splm\\ncsjapi32.exe
%WinDir%\\validate.inf
%WinDir%\\bolivar28.exe
C:\\Windows\\fmark2.dat
C:\\Windows\\fbtre6.exe

Remove Koobface registry values:

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\Intelli Mouse Pro Version 2.0B\\StubPath: "%WinDir% \\System32\\splm\\ncsjapi32.exe"
HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*Intelli Mouse Pro Version 2.0B*: "%WinDir% \\System32\\splm\\ncsjapi32.exe"
HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Intelli Mouse Pro Version 2.0B: "%WinDir% \\System32\\splm\\ncsjapi32.exe"
HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden: "2"
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*Intelli Mouse Pro Version 2.0B*: "%WinDir% \\System32\\splm\\ncsjapi32.exe"
HKEY_USERS\\Software\\Microsoft\\Windows\\nScan32\\ExecuteDate: "14\\8\\2008"
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Current Version\\Run\\"systray" = "c:\\windows\\mstre6.exe"
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Current Version\\Run\\"systray" = "C:\\Windows\\fbtre6.exe"
HKEY_CURRENT_USER\\AppEvents\\Schemes\\Apps\\Explorer\\Navigating

Important Disclaimer

What is a Worm?

Koobface is a Worm.

A worm is a type of virus that replicates by resending itself as an e-mail attachment or as part of a network message. Unlike a regular computer virus, a worm is self-contained and does not need to be part of another program to duplicate itself. A worm hides in active memory and performs malicious acts, such as using parts of the computer’s system resources. Worms are usually invisible to the user and are designed to affect the computer’s performance. A worm take control of remote systems without any help from the users and can delete files, send documents via email, or encrypt files.

Koobface is related to:

  » No related posts

This entry was posted on Friday, December 5th, 2008 at 2:15 pm and is filed under Worms. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.