KoobFace virus

We explain what Koobface is and how it affects users of sites like Facebook and Myspace.

Koobface is a name put forward to describe the assorted variants of malware that spread using the help of social networking sites like Facebook, MySpace and Twitter. Koobface is an anagram of popular site Facebook.

Once a computer is infected with a Koobface virus or worm, it will be checked for evidence of social network site use. Typically this means checking for small files called cookies which automatically install themselves on a users computer when they use social networking sites. Once found, Koobface will use these files to infect the respective profile of the person using the computer. Once the profile is infected what often happens is that profile starts posting various public messages to look like the victim is posting them. For instance, on Facebook, infected profiles will start posting on their own wall and also the walls of the users on the Facebook contacts list. The messages will appear to be from the victim and will contain a link to external websites. This sort of activity is also associated with rogue Facebook applications which spread in a similar way but the link will not be to an external site but to the Facebook application installation page.

The external sites will then trick users into installing the Koobface malware by presenting them with various pop-ups which will request permission to download various supposedly legitimate programs like add-ons to Flash Player, codecs to play videos or add-ons for Adobe software. Once installed, the computer is infected and so too will be the social networking sites used on that computer.

Once installed, Koobface worms and variants can do a variety of tasks associated with other forms of malware. This can include keylogging, spyware, scareware or malware that can give scammers complete control of the victims computer.

Common examples of messages left my Koobface viruses include the promise of intriguing sounding videos, including YouTube videos. Many bait victims into clicking by using messages like –

Check out this YouTube video of you….LINK

Often the links will be disguised with URL shorteners like Bit.Ly or TinyURL.

If you see a suspicious link, verify with the Facebook friend that posted it to see if they actually did post it or if it was the result of malware.

KoobFace Hoaxes

The sudden rise in popularity of Koobface malware has led to many hoaxes being perpetrated using KoobFace as the panic button. Many viral messages have been spread either warning of fake KoobFace viruses or using alarmist and/or misleading information about KoobFace to spread. Members of social networking sites are advised to verify any rumours they may see before thinking about passing them on.

Since Koobface is essentially typical malware, (the only real distinguishing factor is the way is spreads through social networking sites) removal is quite standard. Run up-to-date reliable antivirus software and search for new threats. For our recommendation on good antivirus, click here.

Go Back