Home / White Hat Help / How To Remove KoobFace Worm

How To Remove KoobFace Worm

Koobface is the latest virus that has attacked the social networking phenomenon. Top social networking websites like facebook and myspace are the places where this thing has done nothing but mischief.

The virus originated in early December and is reported to have infected several computers using the facbook platform. Although such a virus has been reported earlier in myspace but this new thing is using different methods to seek into the users PC and spread malware into the computer

KoobFace Variants :

Net-Worm.Win32.Koobface.a, which attacks MySpace
Net-Worm.Win32.Koobface.b, which attacks Facebook
WORM_KOOBFACE.DC, which attacks Twitter
W32/Koobfa-Gen, which attacks Facebook, MySpace, hi5, Bebo, Friendster, myYearbook, Tagged, Netlog, Badoo and fubar
OSX/Koobface.A, a Mac version which spreads via social networks such as Facebook, MySpace and Twitter.

Although famous as virus, the Koobface is actually a worm. A worm is a malware that sneaks into your computer and replicates itself throughout the PC. The difference between a virus and a worm is that, virus attaches it self to the file where as a worm actually replaces it. A worm can even send automated emails to other PC’s trying to infect them using yours.

So Koobface is a worm and attacks a computer by downloading some .exe files into your computer. The main thing is to identify the threat at this point before it is too late.

Basically if you are using facebook you should watch for automated email messages that display either an insulting message or some thing very tempting about you. Messages like, “you look funny in this video” or “you look so stupid in this pic” can be used to persuade somone to click on the link attached, this called ‘Social Engineering’. Once the user clicks on them it takes you to a video which doesn’t play and they ask you to download certain codecs which can be a ‘flash_player.exe’ file.

If this file is downloaded, your computer becomes open to Koobface malware. It downloads a file ‘tinyproxy.exe’ which hijacks your PC. It can even alter search results from Google, Yahoo etc and redirect you to websites selling malicious softwares

How To Remove Koobface Automatically

Here I will discuss two method of removing Koobface. First lets discuss the automatic method. The facebook security page has posted about this but there is no genuine way of removing this malware. They have only asked people to change their password in order to protect user security.

The best automatic method to remove this thing is of course to get a good malware remover which can automatically detect and remove it. If you have already bought a good antispyware you can find the removal instructions from the support page. But it can be removed automatically if your software is updated.

The major problem is that the Koobface worm is constantly changing itself, so make sure you have the latest version of the mlaware installed.

You can use SuperAntiSpyware FREE http://www.superantispyware.com/

How To Remove Koobface Manually

Although it is highly recommended that Koobface or any other parasite should be removed using a automated software but still if you want to do it manually here is the procedure but before attempting anything, make sure you backup your computer

Using The AddRemove Program Tool:

This is not a 100% removal method because most of the malware don’t really appear in the list but if they are you can do this:

Go to AddRemove utility.

Look up for the Koobface malware to remove and uninstall it.
But it is noted that Koobface restores it self on rebooting. So here is a better method:

By Removing Registry Files

Here are the steps:

Search for “koobface” in Mycomputer using find utility.
Note down Koobface file path some where.
Press Ctrl+Alt+Del to open ‘Task Manager’
End the “Koobface” processes.
The following processes must be ended


Now you have to unregister dll file

Go to start and type in ‘cmd’ to open command prompt.
First locate the following dll files using ‘dir’ command.


Now change the current directory using ‘cd’ command leave a space after ‘cd’ and then the path of dll file, which you have located above. Press enter after this.
Now unregister dll file by typing “directory path+’regsvr32/u’+dll file name”. Press enter, the file will be unregistered.
I would once again recommend that you do it automatically since there is risk of damaging the computer as important files may be deleted or changed

credits to my site staff Shatrang




About Admin

Check Also

Get free USA Number

Get free USA Number for Verification on Websites

Get free USA Number for Verification on Websites USA number have many benefits like registration ...

Leave a Reply