StyloSoft

A virus Koob-face  is hitting the facebook. Koob-face is worm  that attacks facebook currently but has been targeted  social networking sites like myspace, Hi5, Bebo.

As we know facebook is famous social networking site which includes 120 million users. Koob-face uses facebook ‘s private  messaging system. When user open his account in facebook then virus gets into user’s computer then it creates spam messages and sends them to the infected user’s friends. After that this worm tries to steal  secret information from your PC  like credit card number , bank account etc.

As koob-face is a worm it spreads itself by sending messages from infected user account to all other user’s friends with subject like “watch this video” , “you look stupid in this vid”, Paris Hilton Tosses Dwarf On The Street, Hello; You must see it!!!. These messages include links which bring user to third party site where they asked from some downloading or updating of software like flash player which is actually virus file… that is point where user starts downloading without thinking. Once the worm is installed it starts its working.

Remove Koob Face Virus From Your Computer

It is very hard to remove this worm from your computer because it is polymorphism worm which is difficult to detect. We can remove it through malware a cleaner that is more preferable but you can also clean your system from this worm manually by following the instructions:

1. Click start on the taskbar, and then click “My Computer.”

2. Hit F3 and select “All Files and Folders and search “Koobface.”

3. Copy the file path of Koobface.

4. Open “Task Manager” this can be done by eithering holding Ctrl+Alt+Del or clicking “Start” and then “Run” and type “taskmgr.exe”

5. You must disable Koobface’s process first.

6. Next you must disable the other following processes

1. %SYSTEMROOT%bolivar28.exe

2. bolivar28.exe

3. che07.exe

4. %WinDir%system32nScanecls.exe

5. %WinDir%system32nScanekrn.exe

6. %WinDir%system32splmncsjapi32.exe

7. %WinDir%bolivar28.exe

8. C:Windowsfbtre6.exe

Now that this is done, it is time to go into the registry and remove this worm.

1. Click “Start” “Run” and type “Regedit”

2. Locate and delete these registry files

1. HKEY_LOCAL_MACHINESOFTWAREMicrosoftActive SetupInstalled ComponentsIntelli Mouse Pro Version 2.0BStubPath: “%WinDir% System32splmncsjapi32.exe

2. HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionRunOnce*Intelli Mouse Pro Version 2.0B*: “%WinDir% System32splmncsjapi32.exe”

3. HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHidden: “2”

4. HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionRunIntelli Mouse Pro Version 2.0B: “%WinDir% System32splmncsjapi32.exe”

5. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce*Intelli Mouse Pro Version 2.0B*: “%WinDir% System32splmncsjapi32.exe”

6. HKEY_USERSSoftwareMicrosoftWindowsnScan32ExecuteDate: “1482008”

7. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrent VersionRun”systray” = “C:Windowsfbtre6.exe”

HKEY_CURRENT_USERAppEventsSchemesAppsExplorerNavigating

9. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrent VersionRun”systray” = “c:windowsmstre6.exe”

Now we must unregister these dll files in Command Prompt.

1. Click “Start”, “Run”, and type “cmd”

2. Now locate and the follwing dll files by typing dir and then the following:

1. %WinDir%system32nScanekrnScan.dll

2. %WinDir%system32nScanekrnEpfw.dll

3. %WinDir%system32nScanekrnEmon.dll

4. %WinDir%system32splmlmfunit32.dll

5. %WinDir%system32splmkbdsapi.dll

6. %WinDir%system32nScanekrnAmon.dll

7. %WinDir%system32splmmcaserv32.dll

now that you have the paths for those now we can change it type “cd” then a space and type the dll path for all of those, and hit eneter and now unregister them.

Now unregister each and by using the following format “path+’regsvr32/u’+dll name”

But don’t do this, it can harm your computer always go for anti-malware software.

Facebook and McAfee is working together to solve this problem it will take some time.

In mean time, by avoiding unexpected email attachments, videos or other links we can protect our PCs.

Comments

comments